Implementing a one-time password system on the web
Not a Token
The RFC 2289 specification for a one-time password solution can offer true two-factor authentication; however, it will never be as secure as a token-based alternative. For one thing, many of the token-based solutions require that you concatenate a private PIN to the OTP to create the second factor, which greatly enhances security. Also, the hardware token solutions are designed to be tamper proof, in case someone tries to reverse engineer the generating algorithm. Finally, the token-based tools are time based and change every minute or so, which means it is very difficult for an attacker to obtain an OTP a user has not yet used. With solutions that require an OTP list, an attacker who gets a snapshot of the list (or picks up a lost list on the subway) has access to future OTP responses.
The OTP system defined by RFC 2289 offers an open and scalable solution for web-based authentication. It is even possible to integrate an OTP system into a user's cell phone. Web-based OTP has its own attack vectors and risks, and a web-based OTP system will probably never be quite as secure as hardware-based solutions such as the RSA SecurID. Despite this, OTP combined with a conventional web authentication scheme is an excellent candidate for poor man's two-factor authentication.
Implementation of the RFC 2289 specification used in OTPauth was written for PHP4 and also works with PHP5. To implement the spec correctly, a variety of bitwise operations are necessary. However, at the time of implementation (and I don't think it has changed), specific bitwise operations do not work in PHP4. Things like bit shifting for unsigned 32-bit integers don't work. PHP4 provides the operator, but it simply fails with no error. Therefore, OTPauth provides a math library to work around these types of undocumented language "features."
- "Smart Access" by Udo Seidel, Linux Magazine, November 2008
- RFC 2289: http://www.apps.ietf.org/rfc/rfc2289.html
- OTPauth: http://code.google.com/p/otpauth/
- otp: http://sourceforge.net/projects/otp/
- OTPs in Java: http://www.java2s.com/Code/Java/Security/OTPonetimepasswordcalculation.htm
- Google AuthSub library: http://code.google.com/apis/accounts/docs/AuthSub.html
- Joomla OTP plugin: http://code.google.com/p/joomla-otp-auth/
- Apache mod_auth_mysql module: http://modauthmysql.sourceforge.net/
- Phishing attack on OTPs: http://www.theregister.co.uk/2005/10/12/outlaw_phishing/
Buy this article as PDF
Kernel king admits his tone has alienated volunteers, but says the demands of the process require directness.
New flaw in an old encryption scheme leaves the experts scrambling to disable SSL 3
Lennart Poettering wants to change the way Linux developers talk to each other.
Enterprise giant frees itself from ink and home PCs (and visa versa).
Mozilla’s product think tank sinks silently into history.
TODO group will focus on open source tools in large-scale environments.
New tool will look like GParted but support a wider range of storage technologies.
New public key pinning feature will help prevent man-in-the-middle attacks.
Carnegie Mellon researchers say 3 million pages could fall down the phishing hole in the next year.
The US government rolls new best-practice rules for protecting SSH.