WHAT DO ONE-TIME PASSWORDS ENTAIL?
- Written by Ester Adams
One time passwords are dynamic. As the name suggests, they are valid for one-time use. After which they become futile. These transactions occur on digital devices and evade breaches of security. They work on several algorithms that make it convoluted for a hacker to exploit people. OTPs are a great alternative to the traditional password system. They leave less room for error.
OTP service providers ensure that the designs are thoroughly secure so the hackers cannot reroute or intercept signals and induce damage. The earlier systems operated on 2-factor authentication, which meant verifying a person's correct identity by accessing a device owned by the individual or using the four-digit card pin.
OTP service providers use pseudorandomness, an algorithm for generating a sequence of numbers whose properties approximate random number sequences. This squelches the probability of an attack. Additionally, professionals use cryptographic hash functions which consolidate the message-passing capabilities of hash functions with security properties. It has several upsides like making the future OTPs unpredictable by tracking the old ones.
MERITS OF USING THE OTP SYSTEM
OTP systems do not fall prey to replay attacks. This concept implies that a potential attacker cannot reuse the OTP as, by the time he/she discovers it, it will already be ineffective. It also shields people who use the same password to protect multiple devices. The attacker could get wind of this password and manipulate the individual's data. But, this possibility is minimised by using OTPs. Their utilisation becomes useless after some time, enhancing the security bind.
People generate one-time passwords using highly obscure algorithms. Such a step confounds the possibility of attackers making easy guesses. Guessing these digits is almost impossible owing to their random nature. Their validity is short-lived, hence disallowing any breach of security.
OTPs also do not succumb to replay attacks. In such scenarios, the hacker intercepts the password, records it and gains access to a person's data. However, the one-time passwords are fleeting, forbidding the attackers from repurposing the passwords.
Many institutions and organisations find it easier to accommodate the OTP system as a security measure. Its cryptic nature enables heightened security.
TYPES OF OTP
Hard tokens
It is a hardware security device that gives the users authorisation. Its primary rationale is to grant access to users. A typical example would be a security card allotted by companies to cede access for their employees into the building. Their usage can occur with enhanced security measures. Such as, along with the security card employees are assigned a username, password or need to use a fingerprint. The different types of hard tokens are:
1) Connected tokens: Users connect the token to a system in an attempt of gaining access. Examples would be USB drives and smart cards.
2) Disconnected tokens: The most prominently used token system for multi-factor authentication are disconnected tokens. It frees the need for physical insertion and depends on pocket-size key fobs, keyless entry systems, mobile phones and security devices.
3) Contactless tokens: These tokens rely on transmitting authentication data to a system, examining the knowledge and ascertaining user access. A great example is Bluetooth tokens that enable contactless transmission.
Soft tokens
As the name suggests, soft tokens are not physical items in possession. They are either virtual or exist as software on laptops and mobile phones. Its authentication occurs on the application that shoots an SMS to verify the identity of the person. Subsequently, the person is granted access. Their functioning is more or less basic: starting with the user sending authentication data to the system, followed by the system verifying the information and granting access.
IS THE OTP SYSTEM SECURE?
Yes, the OTP system is more secure than other methods. It has stayed relevant for so long due to its efficacy. However, the public must steer clear of sharing this OTP with an unknown person. Phishing crimes are highly commonplace where phishers pretend to be a part of a bank or a legitimate company and demand the OTP.
Many individuals have succumbed to this demand and faced dreadful consequences. The Swedish bank was tricked in 2005 to give up their one-time passwords, inducing grave damages. Many such incidents have circled different banks and individuals. The public must take this as a learning moment and abstain from incurring the same fate.
CONCLUSION
All in all, the OTP systems have changed the face of security. It has also sustained a more uncomplicated way of security. Its user-friendly persona has heightened its utilisation.
