One-time-passwords are primarily designed to combat which type of attack?

One-time-passwords are primarily designed to combat which type of attack?

• A. Phishing attack
• B. Replay attack
• C. DDoS attack
• D. Brute force attack

Answer: (B)

One-time passwords (OTPs) are specifically designed to address the vulnerabilities associated with replay attacks. A replay attack occurs when an attacker intercepts a valid authentication request and then reuses it to gain unauthorized access. Since OTPs are used only once and expire after a short period or after they have been used, they significantly reduce the likelihood of an attacker successfully reusing the intercepted password. The mechanism of OTPs ensures that even if an attacker captures the password during a legitimate transaction, they will not be able to use it subsequently, since the password will no longer be valid. This characteristic is what makes OTPs effective against replay attacks. In contrast, attacks such as phishing, DDoS, and brute force have different objectives and exploit different vulnerabilities in security protocols and practices. Phishing is aimed at capturing credentials through deceit, DDoS focuses on overwhelming services with requests, and brute force seeks to guess passwords by trying many combinations.

One-time passwords (OTPs) are specifically designed to address the vulnerabilities associated with replay attacks. A replay attack occurs when an attacker intercepts a valid authentication request and then reuses it to gain unauthorized access. Since OTPs are used only once and expire after a short period or after they have been used, they significantly reduce the likelihood of an attacker successfully reusing the intercepted password.

The mechanism of OTPs ensures that even if an attacker captures the password during a legitimate transaction, they will not be able to use it subsequently, since the password will no longer be valid. This characteristic is what makes OTPs effective against replay attacks. In contrast, attacks such as phishing, DDoS, and brute force have different objectives and exploit different vulnerabilities in security protocols and practices. Phishing is aimed at capturing credentials through deceit, DDoS focuses on overwhelming services with requests, and brute force seeks to guess passwords by trying many combinations.