3 ms·
So if I understand this, this is how it would work. At any time you'd have two passwords: one regular, which you use every day; and one for one-time-use only,
by Zecc 13y ago
So if I understand this, this is how it would work.
At any time you'd have two passwords: one regular, which you use every day; and one for one-time-use only, which you keep around in case of need.
When sitting at an untrusted computer, you use your one-time-use password. This proves your identity, but also immediately expires your one-time-use password. Next time you want to generate a usable one-time-password you'll have to login with your regular password again.
Is that it?
- XorNot 13y agoMore like the OTP token would be on my smartphone or some other device, so I can generate passwords as needed that are guaranteed to be unique. But they don't require my normal password to be entered at all. I'd accept punching in my real password or a code on my phone to generate the smart token, since the time required to brute force something like that would be give me plenty of time to revoke it's authorization.
- Zecc 13y agoAh sure, as long as both the client and the server are in agreement of what the next token should be then everything is fine. I didn't think this through.