Implementing a one-time password system on the web
Not a Token
The RFC 2289 specification for a one-time password solution can offer true two-factor authentication; however, it will never be as secure as a token-based alternative. For one thing, many of the token-based solutions require that you concatenate a private PIN to the OTP to create the second factor, which greatly enhances security. Also, the hardware token solutions are designed to be tamper proof, in case someone tries to reverse engineer the generating algorithm. Finally, the token-based tools are time based and change every minute or so, which means it is very difficult for an attacker to obtain an OTP a user has not yet used. With solutions that require an OTP list, an attacker who gets a snapshot of the list (or picks up a lost list on the subway) has access to future OTP responses.
The OTP system defined by RFC 2289 offers an open and scalable solution for web-based authentication. It is even possible to integrate an OTP system into a user's cell phone. Web-based OTP has its own attack vectors and risks, and a web-based OTP system will probably never be quite as secure as hardware-based solutions such as the RSA SecurID. Despite this, OTP combined with a conventional web authentication scheme is an excellent candidate for poor man's two-factor authentication.
Implementation of the RFC 2289 specification used in OTPauth was written for PHP4 and also works with PHP5. To implement the spec correctly, a variety of bitwise operations are necessary. However, at the time of implementation (and I don't think it has changed), specific bitwise operations do not work in PHP4. Things like bit shifting for unsigned 32-bit integers don't work. PHP4 provides the operator, but it simply fails with no error. Therefore, OTPauth provides a math library to work around these types of undocumented language "features."
- "Smart Access" by Udo Seidel, Linux Magazine, November 2008
- RFC 2289: http://www.apps.ietf.org/rfc/rfc2289.html
- OTPauth: http://code.google.com/p/otpauth/
- otp: http://sourceforge.net/projects/otp/
- OTPs in Java: http://www.java2s.com/Code/Java/Security/OTPonetimepasswordcalculation.htm
- Google AuthSub library: http://code.google.com/apis/accounts/docs/AuthSub.html
- Joomla OTP plugin: http://code.google.com/p/joomla-otp-auth/
- Apache mod_auth_mysql module: http://modauthmysql.sourceforge.net/
- Phishing attack on OTPs: http://www.theregister.co.uk/2005/10/12/outlaw_phishing/
Buy this article as PDF
3ROS attack tool lowers the technical bar so anyone can be an intruder.
Mozilla's latest browser offers powerful new privacy feature
If attackers are on your system, saving your passwords in a password vault is no protection.
Faulty hash algorithm persists, despite efforts by experts to raise awareness.
Powerful man-in-the-middle attack is now targeting online shopping.
Another high-profile coder says the kernel team needs a kinder, gentler culture.
Bug database has a bug of its own that could allow an intruder to create an unauthorized account.
Report focuses federal resources on achieving universal Internet access.
Leading browser makers say “no” to porous encryption algorithm