<div dir="ltr">Internally we make use of HOTP (via linotp) for our VPN and it works around the problem of the long lived tokens by letting you use it only once. The difference in implementation is not so great, it wouldn't take long to build it in fact I've already created a PR for the java project.<div><br></div><div><a href="https://github.com/aerogear/aerogear-otp-java/pull/16">https://github.com/aerogear/aerogear-otp-java/pull/16</a><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 24, 2015 at 2:28 PM, Bruno Oliveira <span dir="ltr"><<a href="mailto:bruno@abstractj.org" target="_blank">bruno@abstractj.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Good morning Erik, I'm not against the implementation, but I have some<br>
considerations.<br>
<br>
As you might know TOTP is short-lived, which means that they only apply<br>
for certain amount of time, while HOTP is long-lived, which means that<br>
someone eavesdropping the network could collect several HOTPs and reuse<br>
then later.<br>
<br>
Other thing to keep in mind is how to demo HOTP, at the moment we don't<br>
have a server neither bandwidth do implement one.<br>
<br>
Implement it or not it's up to you, but I would like to make sure that<br>
you're aware about the issues with HOTP.<br>
<div><div class="h5"><br>
On 2015-03-23, Erik Jan de Wit wrote:<br>
> Hi,<br>
><br>
> I was adding otp support for windows and that started to make me wonder if<br>
> it would be nice to add HOTP as well as TOTP for instance our linotp server<br>
> uses this. The only difference between the two is that HOTP uses a counter<br>
> that is incremented and TOTP is time based. So it would be fairly easy to<br>
> implement and for instance on windows there aren't any apps that support<br>
> both.<br>
><br>
> Wdyt?<br>
><br>
> --<br>
> Cheers,<br>
> Erik Jan<br>
<br>
</div></div>> _______________________________________________<br>
> aerogear-dev mailing list<br>
> <a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
<br>
<br>
--<br>
<br>
abstractj<br>
PGP: 0x84DC9914<br>
_______________________________________________<br>
aerogear-dev mailing list<br>
<a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">Cheers,<div> Erik Jan</div></div></div>
</div>