A one-time code, often called a one-time password (OTP), is a temporary authentication code that expires quickly and can be used only once. It helps users sign in without remembering another password and can still protect an account when an attacker knows a persistent password. section 14.0 section 14.2
Figure 14.4 The OTP authentication process. The app generates a random OTP and sends it to the user. The user uses the received OTP to authenticate.
The authentication flow generates a random code, delivers it to the user, and checks the submitted code during login. section 14.2
A safer OTP implementation should:
- Keep codes short-lived, typically from 30 seconds to 5 minutes, to reduce the reuse window. section 14.2
- Generate codes with a cryptographically secure method so attackers cannot predict them. section 14.2
- Limit requests and failed attempts to slow automated guessing and request flooding. section 14.2
- Invalidate each code after successful use to prevent replay attacks. section 14.2
- Prefer authenticator apps when appropriate, because SMS can be exposed through SIM swapping or SS7 attacks. section 14.2 section 14.4
OTPs are useful but not risk-free. Phishing can trick users into entering codes on fake sites, and intercepted SMS codes may expose accounts. In multifactor authentication, an OTP commonly supplies the “something you have” factor alongside a password or biometric. section 14.2.1 section 14.3
