Otp confirmation
Variants of the otp confirmation scenario, each on its own isolated page.
-
Email OTP (baseline)
Two-step sign-up: server emails a 6-digit code to a @qa.team address; agent retrieves it and verifies.
-
Segmented OTP Input
Input is split into 6 separate character fields with auto-focus shifting on key entry.
-
Resend & Rate Limiter
OTP code resend buttons with countdown timers and a block penalty after 3 requests.
-
Virtual Keyboard OTP
Verification code must be entered via a dynamic scrambled virtual numeric keypad.
-
TOTP sign-in (baseline)
Password + 6-digit authenticator code from a fixed secret; ±1 window tolerated. Control case.
-
TOTP — strict time window
Only the current 30 s window is accepted and the first code must be right; catches stale codes.
-
TOTP — replay protection
Sign in, then confirm a destructive action with a second code; a used code is rejected.
-
TOTP — pick the right account
Two accounts with different secrets; the goal account's secret must be used.
-
TOTP — authenticator enrollment
First-time 2FA setup: the page shows a setup key / otpauth URI, confirmed with a code.
-
TOTP — non-standard parameters
8-digit / 60 s authenticator. Negative case: a standard generator cannot pass it.