Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

2
  • I somehow back this since HMAC could be really a overkill for what's basically needed. Could you reflect more on what's TOTP in layman terms and why it's any different than OTP? Commented Sep 2, 2015 at 11:33
  • The only difference is in the formal definition - a one time token is exactly that - once issued, it can only be used once. a timed one time token can be used any number of times within a time step - for example 5 seconds or 1 hours depending on the application. In short sessions with several transactions there is less network overhead with a timed token. In longer running sessions, say someone editing a document, you would want a longer time step and ability to refresh the token. HTH! Commented Sep 7, 2015 at 6:15