Best practices/algorithm/approach for implementing temporary transaction password for banking/financial website.

Question

What are the best practices for implementing temporary transaction password feature for website?

For e.g in banking/finance scenarios like - While transfering funds from one account to another, a transaction password is required - While commiting a trade, a transaction password is required - etc.

The password should be temporary and time based i.e. this password should not work after x minutes has elapsed.

What algorithm would you recommend? Do you suggest keeping track of used passwords i.e. store used password in some store?

Some website use a OneTimePassword device. Apart from this please feel to highlight any other strategy you think may be appropriate.

Any other thoughts/suggestions/algorithm welcome.

Edit: Based on question from 'lassevk'

1. The password would be communicated by email/phone/sms.
2. There is no third site involved.

I require this for additional level of security for critical points in the application. This may also be called as "AuthenticationCode".

Answer 1

Edit after updated question:

Well, one way would be to simply store it in the session variable, that would make it forcibly go away whenever the service is restarted.

Additionally you would need to have a timer on it, basically you store expiration time+password somewhere, and whenever you check the password, if the expired time is in the past, you don't have a password and just clear it.

If you encapsulate this away in some base code that not only checks if the right password is given, then it would need to be able to answer both yes, no, and no password stored so that you can give the appropriate message to the user.

---

A couple of questions:

• How would you communicate the temporary password to the user? SMS?
• Is the password for the same site, or is it created for another, linked, site? (ie. your bank main site generates or gets hold of the password, and you use that to log on or authorize the transaction on another, related, site?)

If the answers are:

• Via the website
• No, same site

Then what's the point? What are you hoping to gain from this? What are the specific criteria or goal for implementing this feature?

Answer 2

Well It really differs from institutions to institutions

Creating a Financial PIN on the basis of Sessions would be more securer strategy rather then creating a FPIN that works for particular time period.

If you have resources to SMS the FPIN then the best practice would be to Generate FPIN before every transaction and SMS the FPIN to user that would be some thing like 2FA.

Regards Azeem.