[Otpasswd-talk] User state information & OOB usage

[Hannes Beinert]

Tomasz,

I noticed that you had a timestamp field for the last OOB channel use.
 Where is the passcode kept?  Or is the idea that the PAM module get
that passcode directly, and that it's stored in the process context?

The latter assumes that one is able to wait at a passcode prompt until
the OOB channel actually manages to deliver the passcode.  That's
probably a decent bet, nowadays, I suppose.  But if that delay time
gets too large, it could be inconvenient.

Another way to go about this is to use the login prompt (and/or a
website) to prompt the transmission of the passcode to the user.
Meanwhile, that passcode would be stuffed into the user state file
with the timestamp.  Then, next time a login happens, if it's within
the time window set by policy, the user would use that passcode to
authenticate.

Just thinking aloud.

Hannes.