OTP proposals: A case of telecom regulatory overreach?

Newly proposed cyber security rules aim to tackle OTP misuse but may expose users to other risks

- RAHUL MATTHAN

As transactions have grown increasingly digital, service providers rarely (if ever) come face-to-face with their customers. This means that without reliable means of authentication, they have no way to ensure that the products and services they sell actually end up in the hands of those who bought them.

One way to address this would be to insist on multiple factors of authentication. In practical terms, this means that in addition to proving who you are in reference to 'something you know' (such as a PIN or a password), you would also be required to do so with reference to 'something you have' (such as a hardware token or a mobile device) or 'something you are' (such as a fingerprint or another biometric identifier).

In India, the most widely used additional form of authentication is the one-time password (OTP), a number sequence sent to your mobile phone (since this is 'something you have') to validate that you are who you say you are. There are many reasons why these are preferred. OTPs are only valid for a single session, which means that an attacker who gains access to one will not be able to reuse it, and, since it has limited validity, has just a small window within which to misuse it.