Today, deployment of two-factor authentication remains extremely limited in scope and scale. Despite increasingly higher levels of threats and attacks, most Internet applications still rely on weak authentication schemes for policing user access. The lack of interoperability among hardware and software technology vendors has been a limiting factor in the adoption of two-factor authentication technology. In particular, hardware and software components are often tightly coupled through proprietary technology, resulting in high cost solutions, poor adoption and limited innovation.
In the last two years, the rapid rise of network threats has exposed the inadequacies of static passwords as the primary mean of authentication on the Internet. At the same time, the current approach that requires an end-user to carry an expensive, single-function device that is only used to authenticate to the network is clearly not the right answer. For two factor authentication to propagate on the Internet, it will have to be embedded in more flexible devices that can work across a wide range of applications.
One Time Password is certainly one of the simplest and most popular forms of two-factor authentication for securing network access. For example, in large enterprises, Virtual Private Network access often requires the use of One Time Password tokens for remote user authentication. One Time Passwords are often preferred to stronger forms of authentication such as PKI or biometrics because an air-gap device does not require the installation of any client desktop software on the user machine, therefore allowing them to roam across multiple machines including home computers, kiosks and personal digital assistants.