Passwords are easily phished, captured, replayed, or otherwise compromised. To address weaknesses in passwords, two-factor authentication was developed and is commonly deployed by websites and companies. Most two-factor authentication operates by adding an additional security challenge after prompting a user for primary password-based authentication.
One model of two-factor authentication is one-time passcodes (OTPs). In this model, the user employs an OTP-generating device to generate a short, user friendly passcode (usually 6 or 8 numeric digits) and provides that passcode to the validating service (usually by typing it in to an input box).
The OTP-generating device and the validating server both share a secret and employ an algorithm that allows them to agree upon what passcode to expect. OATH HOTP and TOTP are two open standards for OTP-based authentication.
Each passcode can only be used once and every time the user goes to log in, their OTP-generating device will generate a new and different passcode. So while attackers may still compromise/phish a user's static password, if they capture/observe an OTP, it can only be used once and not replayed at a later time. Use of OTP authentication passcodes, however, can be cumbersome from a usability perspective. While OTP-based authentication offers security gains, the usability of a human transcribing an ever-changing passcode (often racing a countdown timer in time-based OTPs) from one device to another leaves much to be desired.
Thus, there is a need in the authentication field to create a new and useful system and method for converting one-time passcodes to app-based authentication. This invention provides such a new and useful system and method.
USPTO Backgrounds
USPTO Backgrounds