HOTP
HMAC-based One-Time Password (RFC 4226). A counter-based one-time code and the basis for TOTP. Largely superseded by time-based codes and phishing-resistant methods.
HOTP is mostly of historical interest now, but the counter model still shows up in hardware tokens and legacy banking devices. Its practical weakness beyond phishability is desynchronization: if the token advances without the server seeing it, the two drift apart and need a resync window, which is itself an attack surface. Time-based codes replaced it, and origin-bound credentials are replacing those.
See also: TOTP, MFA, phishing-resistant MFA, MFA vendors
Related on Start with Identity
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossaryCJIS Security Policy
The CJIS Security Policy is the FBI's set of minimum security requirements for anyone who accesses, processes, stores or transmits criminal justice information
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- BlogThe SMS off-ramp has a date now: what Entra, GOV.UK and America.gov mean for your MFA plan
Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and t