OTP Verification

OTP (One-Time Password) verification is how survivors prove their identity when accessing a will. This guide explains the process in detail.

Overview

When a will transfer is initiated, survivors must verify their identity before they can contribute to reconstructing the encryption key. OTP is the primary verification method.

How OTP Works

Generation

1. Survivor selects their name in the portal
2. System generates a random 6-digit code
3. Code is hashed before storage (for security)
4. Code is sent to survivor's contact method

Delivery

The system tries contact methods in priority order:

Primary → Secondary → Tertiary → Quaternary

If the primary fails (e.g., email bounces, phone unreachable), it automatically tries the next.

Verification

1. Survivor enters 6-digit code
2. System hashes input and compares to stored hash
3. If match → verified; if not → error

OTP Screen

When you're ready to verify, you'll see:

┌─────────────────────────────────────────────────────────────┐
│                    VERIFY IDENTITY                          │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  We've sent a verification code to:                         │
│  j***@example.com                                           │
│                                                              │
│  Enter the 6-digit code:                                    │
│  ┌───┬───┬───┬───┬───┬───┐                                │
│  │ 1 │ 2 │ 3 │ 4 │ 5 │ 6 │  [Submit]                     │
│  └───┴───┴───┴───┴───┴───┘                                │
│                                                              │
│  ────────────────────────                                   │
│                                                              │
│  Didn't receive it?                                         │
│  • Check spam/junk folder                                   │
│  • [Resend Code]                                            │
│  • [Use Backup Code]                                        │
│                                                              │
│  Code expires in 10:00                                      │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Step-by-Step Process

Step 1: Select Your Name

1. Access the survivor portal link
2. Find your name in the survivor list
3. Click to select
4. Click "Continue"

Step 2: Wait for OTP

• Code is sent automatically after selection
• Typical delivery time:
  • Email: < 30 seconds
  • SMS: < 10 seconds
  • WhatsApp: < 10 seconds
  • Telegram: < 10 seconds

Step 3: Enter Code

1. Type the 6 digits
2. Click "Submit"
3. Or press Enter after entering all 6 digits

Step 4: Success or Failure

Success:

• You see confirmation
• Your share is decrypted in server memory
• Progress updates to show you're authenticated

Failure:

• Incorrect code entered
• Shows remaining attempts
• Can retry or use backup code

OTP Security

Constraints

Why These Limits?

• 6 digits: 1 million possible codes (sufficient for low-value, rate-limited verification)
• 10 minutes: Long enough to receive and enter, short enough to limit exposure
• 3 attempts: Prevents brute force while allowing typos
• 5/hour: Prevents automated attacks while allowing retries

Security Features

• Hashed storage: Even if database is compromised, codes can't be used
• Rate limiting: Prevents brute force attacks
• Time expiry: Limits window for attack
• Unique per session: New code each verification attempt

Backup Codes

If you can't receive OTP, use a backup code.

Using Backup Code

1. Click "Use Backup Code" on the verification screen
2. Enter your 8-character code: A3F7-K9M2
3. Click "Submit"

Backup Code Properties

• Format: 8 alphanumeric characters
• Case-insensitive: a3f7k9m2 works same as A3F7-K9M2
• Single-use: Each code works once
• No expiration: Unlike OTP, backup codes don't expire

Getting Backup Codes

The host provides backup codes when you're added as a survivor. They're shown only once at that time.

If you didn't receive them:

• Contact the host
• Host can regenerate codes (invalidates old ones)

Failed Attempts

Too Many Attempts

After 3 wrong OTP attempts:

• Current code is invalidated
• Must request new code (or use backup code)

Rate Limited

After 5 OTP requests per hour:

• Must wait before requesting more
• Use backup code instead

Code Expired

After 10 minutes:

• Code no longer valid
• Request a new code

Troubleshooting

Not Receiving OTP

Check all channels:

1. Email (check spam/junk)
2. SMS
3. WhatsApp
4. Telegram

Common issues:

• Phone number wrong → Contact host
• Email typed wrong → Contact host
• Email in spam → Check spam folder
• Phone off/airplane mode → Enable and wait

Wrong Number Entered

• Clear the input
• Enter carefully
• Or click "Resend" for fresh code

"Invalid Code" After Correct Entry

• Ensure no leading/trailing spaces
• Check you're using right code
• Try backup code if available

Lost Backup Codes

If all backup codes used and no OTP delivery:

• Cannot authenticate
• Contact other survivors
• May need to wait for transfer to fail

Wrong Name Selected

If you selected wrong name:

• Can't change after selection in same session
• Contact host or wait for timeout

Resending OTP

Manual Resend

Click "Resend Code" to:

• Get a fresh code
• Sent to primary connector
• Resets attempt counter

Automatic Resend

If primary connector fails, system automatically tries next in priority.

Rate Limit on Resend

Max 5 OTP requests per hour per survivor.

Best Practices

For Smooth Verification

1. Check notification channel — Know which one you'll receive
2. Have backup ready — Know where backup codes are
3. Act quickly — Verify soon after notification
4. Check spam — Email often goes there

If Having Trouble

1. Wait 30 seconds for delivery
2. Check all channels
3. Try backup code
4. Contact host if all fails

What Happens After Verification

After you successfully verify:

1. Your SSS share is decrypted in server memory
2. You're shown as authenticated on the progress screen
3. System checks if threshold is met
4. If met → documents become accessible
5. If not met → wait for other survivors

Summary

OTP verification is designed to be:

• Simple — Just enter a code
• Secure — Rate limited, hashed, time-bounded
• Accessible — Multiple channels, backup codes
• Fast — Usually under 30 seconds

Next Steps

• Accessing Documents — After verification
• Receiving Access — Overview