In Focus

// Research series

Authentication Ceremonies

How authentication succeeds or fails across credentials, recovery paths and session creation.

2-part series · Read in order

// Reading path

From first question to final consequence.

All series →
  1. Part 1Six digits are not the authentication ceremony.An OTP output is short and temporary. Its real security depends on seed custody, moving-factor state, verification policy, session binding and recovery.
  2. Part 2SMS OTP is now a restricted authenticator. The hard part is what replaces it.Leaving SMS removes the telephony channel, but phishing resistance depends on origin binding and on every recovery path that can create a session.
Six digits are not the authentication ceremony.

Six digits are not the authentication ceremony.

by | Jul 1, 2026 | Research

ONE-TIME PASSWORDS What HOTP and TOTP prove, and why the surrounding ceremony matters more than the six digits. A one-time password looks self-contained. A token displays six digits. A user copies them. A server accepts or rejects the value. The visible code is only...