Implementing a one-time password system on the web
Not a Token
The RFC 2289 specification for a one-time password solution can offer true two-factor authentication; however, it will never be as secure as a token-based alternative. For one thing, many of the token-based solutions require that you concatenate a private PIN to the OTP to create the second factor, which greatly enhances security. Also, the hardware token solutions are designed to be tamper proof, in case someone tries to reverse engineer the generating algorithm. Finally, the token-based tools are time based and change every minute or so, which means it is very difficult for an attacker to obtain an OTP a user has not yet used. With solutions that require an OTP list, an attacker who gets a snapshot of the list (or picks up a lost list on the subway) has access to future OTP responses.
The OTP system defined by RFC 2289 offers an open and scalable solution for web-based authentication. It is even possible to integrate an OTP system into a user's cell phone. Web-based OTP has its own attack vectors and risks, and a web-based OTP system will probably never be quite as secure as hardware-based solutions such as the RSA SecurID. Despite this, OTP combined with a conventional web authentication scheme is an excellent candidate for poor man's two-factor authentication.
Implementation of the RFC 2289 specification used in OTPauth was written for PHP4 and also works with PHP5. To implement the spec correctly, a variety of bitwise operations are necessary. However, at the time of implementation (and I don't think it has changed), specific bitwise operations do not work in PHP4. Things like bit shifting for unsigned 32-bit integers don't work. PHP4 provides the operator, but it simply fails with no error. Therefore, OTPauth provides a math library to work around these types of undocumented language "features."
- "Smart Access" by Udo Seidel, Linux Magazine, November 2008
- RFC 2289: http://www.apps.ietf.org/rfc/rfc2289.html
- OTPauth: http://code.google.com/p/otpauth/
- otp: http://sourceforge.net/projects/otp/
- OTPs in Java: http://www.java2s.com/Code/Java/Security/OTPonetimepasswordcalculation.htm
- Google AuthSub library: http://code.google.com/apis/accounts/docs/AuthSub.html
- Joomla OTP plugin: http://code.google.com/p/joomla-otp-auth/
- Apache mod_auth_mysql module: http://modauthmysql.sourceforge.net/
- Phishing attack on OTPs: http://www.theregister.co.uk/2005/10/12/outlaw_phishing/
Vendor D-Wave scores big with a sale to NASA's Quantum Intelligence Lab.
Many package updates and Steam integration highlight the latest from the Mandriva-based community Linux.
Richard Stallman calls for the W3C to remain independent of vendor interests.
The new release supports nine architectures, 73 human languages, and zero non-Free components.
Fedora developers release the first alpha version of Fedora 19, known as Schrödinger’s Cat, for general testing. The final release is expected in July 2013.
ack is a grep-like, command-line tool that has been optimized for programmers to search large trees of source code.
New features in SUSE Studio 1.3 include enhanced cloud integration, VM platform support, and lifecycle management.
The Linux Foundation recently announced that the Xen Project is becoming a Linux Foundation Collaborative Project.
Open source version of LiveCode is now available for developing apps, games, and utilities for all major platforms.
OpenDaylight is an open source software-defined networking project committed to furthering adoption of SDN and accelerating innovation in a vendor-neutral and open environment.