They’re actually not, they’re algorithmically derived state machines, most are public key hashes of secrets concatenated to the current time in seconds from the epoch.
Ideally they would be otp, but that would also be obnoxious.
Yeah, I think it’s because that’s where the model originated, and that’s basically what it’s supposed to be, but having almost everyone synchronized on time gives us a new trick because we can just generate ‘keys’ and have them expire, so even if you manage to get one by force, it’s only valid a short window. Instead of one time pad they often call them one time passwords.
You need extended access to a generator over time to be able to use it, which gives the user a chance to report it for invalidation.
Not perfect, but it does its job fine especially compared to passwords or sms (where you’re at the mercy of the minimum wage kid down at the mall’s Verizon kiosk).
Ah, gotcha. Those are one-time passwords. Same acronym, so it’s easy to confuse them.
But yeah, I agree that everything should use (T)OTP for two-factor authentication, instead of SMS messages. The later mainly provides a false sense of security and presents only a minor hurdle for attackers to overcome.
OTP 2FA Codes are one time pads
They’re actually not, they’re algorithmically derived state machines, most are public key hashes of secrets concatenated to the current time in seconds from the epoch.
Ideally they would be otp, but that would also be obnoxious.
Oh, interesting. Okay. In that case, they are totally misusing the term.
Yeah, I think it’s because that’s where the model originated, and that’s basically what it’s supposed to be, but having almost everyone synchronized on time gives us a new trick because we can just generate ‘keys’ and have them expire, so even if you manage to get one by force, it’s only valid a short window. Instead of one time pad they often call them one time passwords.
You need extended access to a generator over time to be able to use it, which gives the user a chance to report it for invalidation.
Not perfect, but it does its job fine especially compared to passwords or sms (where you’re at the mercy of the minimum wage kid down at the mall’s Verizon kiosk).
Ah, gotcha. Those are one-time passwords. Same acronym, so it’s easy to confuse them.
But yeah, I agree that everything should use (T)OTP for two-factor authentication, instead of SMS messages. The later mainly provides a false sense of security and presents only a minor hurdle for attackers to overcome.