HOTP
HMAC-based One-Time Password (RFC 4226). A counter-based one-time code and the basis for TOTP. Largely superseded by time-based codes and phishing-resistant methods.
HOTP is mostly of historical interest now, but the counter model still shows up in hardware tokens and legacy banking devices. Its practical weakness beyond phishability is desynchronization: if the token advances without the server seeing it, the two drift apart and need a resync window, which is itself an attack surface. Time-based codes replaced it, and origin-bound credentials are replacing those.
See also: TOTP, MFA, phishing-resistant MFA, MFA vendors
Related on Start with Identity
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossaryMagic Link
A passwordless login where the user clicks a one-time link sent to their email. Simple to ship but inherits email security and deliverability limits, and is not
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.
- CVEVault TOTP login MFA bypass
Vault's TOTP login MFA could be bypassed. Companion to the LDAP MFA bypass in the VaultFault set. Confirm the score against NVD; vendor and researcher figures c