What are one-time passwords and their pros and cons?

When you go on a vacation, you’re probably extremely vigilant with the security of your home. You lock all the windows and doors, and even activate the security camera if you have one installed. After all, you can’t be too careful.

Learn about two-factor authentication

Discover key forensics concepts and best practices related to passwords and encryption. This skills course covers

⇒ Breaking password security

⇒ Breaking windows passwords

⇒ Two-factor authentication

Start your free trial

But how vigilant are you when it comes to securing your digital accounts? Do you take steps to create complex passwords? Do you store them in a folder that’s only known to you? Even if you do, isn’t it possible for a hacker to remotely access your system and cause all kinds of harm? Unfortunately, many people need to take cybersecurity more seriously.

As the number of people using the internet to shop, learn, earn and socialize increases, it’s no longer enough to rely on complex passwords to keep intruders at bay. Businesses that store people’s information (banks, ecommerce firms, social media companies and so on) have realized this, which has led them to take extra measures to prevent fraudulent activities and improve account security.

Two year's worth of NIST-aligned training

Deliver a comprehensive security awareness program using this series' 1- or 2-year program plans.

Book a Demo

One increasingly popular measure is the use of one-time passwords, which provide an additional level of security by generating a PIN code that’s valid for just one login session or transaction. How exactly does it help? Let’s take a closer look.

How does a one-time password work?

A one-time password (OTP) is sent to the mobile device of the person who wants to log into his/her digital account. It helps in verifying his/her identity and should be used within a specific period. As soon as the OTP enables access to the account, its validity comes to an end. Since the password (a four or six-digit numerical PIN code in most instances) can be entered just once, it’s not as risky as static passwords that can be used a second time.

Using an OTP can not only save you a lot of expenses and headaches but also provide your clients with peace of mind, knowing that their credentials are safe. If a customer’s account details are compromised, the authorization process won’t be completed without the correct OTP sent to his/her registered mobile account. In case a customer mistakenly enters the wrong OTP, they can always request a new code (up to three times) to gain account access.

 One-time passwords function via random algorithms that create a new and random code each time a new password is requested. The code then serves as your second password that’s distinct to every account login and expires three to five minutes after you get it. This makes an OTP ideal for some of the most privileged and sensitive activities performed on the internet.

Who’s responsible for authenticating OTPs?

Where there are one-time passwords, there’ll be a central authority to check their validity. The responsibility is often delegated to authentication servers, which can either exist in the form of hardware controllers or software tools. The servers verify if the code put in by the users on the device is correct before it allows them to log into their accounts.

 Authentication servers typically generate one-time passwords based on time, “synchronized” with the OTP code/token as well so that they leverage the same numeric values to arrive at the same OTP. Another approach involves using mathematical algorithms which are derived from the values of the previously used one-time passwords. The authentication servers also integrate with enterprise directories such as AD/LDAP and feature a web-based dashboard for easier control and management.

 Some providers also offer applications that make it easier to administer one-time passwords. For instance, if an OTP is associated with a device and the person forgets his/her device at home, they can sign into the web app of the OTP provider to request a one-time password on their email, just for a single day. The same app can also be used to request a new PIN code if the previous one has been lost or wrongly entered. Users can even report the damaged or lost codes/tokens to the administrators via the app.

Pros and cons of one-time passwords

Here are some of the biggest benefits of using OTP. 

Pros

Is safe from replay attacks?

The biggest advantage offered by OTPs in contrast to standalone passwords is that they’re safe from replay attacks. In plain language, an adversary who uses trickery to capture your OTP can’t reapply it, since it’s no longer valid for future logins or sessions. 

Allows you to keep your emails safe 

OTPs are generally received on mobile devices via SMS. This means you don’t need to have access to your email. Hence, you can avoid logging into your email account on public computers or while you’re connected to an unsecured Wi-Fi hotspot.

Is convenient to use?

Most individuals own a mobile phone, and SMS functionality exists on every device. SMS’s ubiquity means that one-time passwords are convenient to use. This is also beneficial for businesses that deliver the OTPs, as end users are already familiar with their phones and don’t need another device to receive the code. As a result, OTPs allow companies to not only enhance the user experience but also reduce their operational costs.

Cons

Could get out of sync 

Electronic codes have their fair share of problems. Algorithm-based OTPs need to cope with drifting out of sync with the authentication server if the system needs the OTP to be submitted by a deadline. Fortunately, the problem can be easily avoided by using a time-synchronized system. These systems prevent such issues by maintaining a time clock in electronic codes.

Can lock you out of your account

If your OTP device is ever stolen or lost, multiple login attacks by the hacker can permanently lock you out of your account. This can be a hassle when you’re traveling, as getting in touch with the OTP provider may require an international call, incurring expensive roaming charges. And if the provider doesn’t limit the number of login attempts, the adversary may still be able to hack your account through brute force.

May be costly for the providers

For OTP providers, costs can be a problem, especially if they’re offering OTP hardware. Other issues with hardware devices are that they can be stolen, damaged or lost. Moreover, users will need to go through the hassle of charging when battery life comes to an end. The best way to avoid these problems is to deliver one-time passwords via SMS messaging.

Conclusion 

If you consider the usage, pros and cons of OTPs, every user can enhance their account security by leveraging a unique password for every single login. As long as the provider is using time-based synchronization and you have your mobile or OPT hardware with you, you can prevent threat actors from spoofing your account credentials. Plus, you get to avoid public computers that may have keystroke loggers and other token-capture software or hardware installed. 

Get six free posters

Reinforce cybersecurity best practices with six eye-catching posters found in our free poster kit from our award-winning series, Work Bytes.

Download Now

Sources

1. Mijin Kim, Byunghee Lee, Seungjoo Kim, and Dongho Won, “Weaknesses and Improvements of a One-time Password Authentication Scheme,” International Journal of Future Generation Communication and Networking, December 2009
2. You can use OTP – One Time Password for stronger authentication, exciTingIP.com
3. Indrajit Das and Ria Das, "Mobile Security (OTP) by Cloud Computing,” International Journal of Innovations in Engineering and Technology, August 2013