[T]OTPs Are Not As Secure As You Might Believe
summary
Short numeric OTPs and typical delivery windows let brute force succeed over time: math and an open‑source simulator show 91% chance in one day for a 4‑digit OTP with 5 attempts and 3‑minute windows, a six‑digit scheme rises to ~99% in six months under repeated requests, and parallel attacks against many accounts make success much faster. The author builds a simulator that matches the formulas, demonstrates sliding‑window TOTP effects, and evaluates mitigations like stronger entropy, strict rate limits, incremental delays, captchas and fallback to U2F.
AI-written summary · about
chapters (8)
- 0:00Start
- 3:15Short Story
- 4:39Design bugs
- 5:50Implementation bugs
- 8:10Attacking a Single OTP
- 17:03Brute forcing windows
- 35:11Final thoughts
- 38:02Mitigations
related talks
24m2FA in 2020 and Beyond
48m2FA2Furious: New Threats to MFA
17m2FA in 2020 & Beyond
22mA Usability Study of Five Two-Factor Authentication Methods
24mTwo Factor Failure
45mOTP Bot Attacks
47mLet’s stop blaming our users for getting hacked when it is our problem to solve
47mThe Psychology of Multi-Factor Authentication