Inherent vulnerabilities of one-time passcode mechanisms

Traditional user identification and authentication mechanisms are no longer considered adequate protection due to the sophistication of hackers and hacker tools. One-time passcode mechanism are becoming commonly used. However, these mechanisms do have vulnerabilities that should be considered when evaluating a product. This paper covers two vulnerabilities, a passive attack used when a one-time passcode card is in two databases and an active attack of masquerading as a one-time passcode server to steal the information to be able to masquerade as a user