What are the advantages of TOTP over HOTP?

HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What advantages it introduces?

-

One of the advantages is purely on the human side of security. From RFC 6238's abstract:

The HOTP algorithm specifies an event-based OTP algorithm, where the moving factor is an event counter. The present work bases the moving factor on a time value. A time-based variant of the OTP algorithm provides short-lived OTP values, which are desirable for enhanced security.

(Emphasis mine.)

The TOTP passwords are short-lived, they only apply for a given amount of human time. HOTP passwords are potentially longer lived, they apply for an unknown amount of human time.

The reference to "enhanced security" is referencing (at least) two areas: The value of a compromised key, and ability to attack one.

First, should a current HOTP password be compromised it will potentially be valid for a "long time". Ensuring frequent use of the HOTP in human time is not a part of the HOTP design, so it is unknown how long the current HOTP password will be valid for and we have to assume the worst case, namely, that it will be a "long" time. This allows the attacker to use a compromised password at their leisure. But should the current TOTP be compromised, it will not be useful for very long because in one TOTP time increment it will be invalidated. Of course, in theory the attacker could grab and use the password in negligible time, but it does prevent a practical human aspect. For example, someone who gets a look at your current Paypal key (which rotates every 30 seconds, IIRC) can't go home and try to use it later, they would have to lunge for a computer in the moment. Someone who compromises they key may not realize it until after the key has expired. Etc.

Second, if you are attacking a key, your work is potentially invalidated or set back every time increment of the TOTP because the target has moved. Perhaps an attacker has discovered an attack against an OTP scheme that allows them to predict the next password only if they have some number of the last 10 passwords, but it takes about 2 hours of computing time to do so. If the OTP changes every minute, their attack is pretty much useless. Brute-force attacks are inhibited as well, because the next password is chosen the same distribution each time; it is possible to brute-force exhaust the password space and not find the password. TOTP doesn't eliminate those sorts of attacks, but hopefully it limits which ones have the ability to be effective.

-
Is there any case where HOTP requires an internet connection while TOTP doesn't? Or vice-versa? –  Jader Dias Mar 30 '12 at 1:28
I think the real challenge is getting the time to be SYNCHRONIZED on the client end along with the server , in case of TOTP. –  Franklin Jun 3 '12 at 7:24
@JaderDias - Neither of the algorithms need an internet connection –  user93353 Sep 6 '13 at 1:10

Neither is worthwile. Changing number codes were invented by RSA in 1984 to block keyloggers. More than 90% of todays internet breakins take place as a result of phishing, and we're seeing incidence of entire countries having more malware infected machines than clean ones (the boleto bandits, have pocketed \$1bn cash so far, & are still going strong).

TOTP and HOTP are almost completely ineffective against todays' risks.

You need solutions that include mutual authentication, and transaction verification, not 30-years-old gizmos.

-
This answer makes no sense in relation with the question. TOTP and HOTP are intended as a form of authentication (usually as a what-you-have factor as the values are read off a token). They have nothing to do with other aspects of establishing a secure channel. –  Gilles Aug 25 '14 at 14:23
@Chris I must be missing something… how does that answer the question asking about the potential advantages (comparing RFC 4226 and RFC 6238)? Also, you state TOTP and HOTP are almost completely ineffective against todays' risks. – do you have any reliable source to backup that statement? (Note that I’m not asking for a link to some weird blog, but for a pointer to one or more scientific papers that provide analysis and proofs to the “complete ineffectiveness” you claim to exist.) –  e-sushi Aug 25 '14 at 18:05