Definition
TAN List
A TAN list is a printed list of precomputed one-time passwords communicated to the user over a secure channel.
Each password on the list can be used only once.
Usage
Second Factor
TAN lists are typically used as a second factor to confirm the execution of security-critical operations (for example, bank transfers).
The user is asked to provide a specific entry from the list (for instance, “enter TAN number 42”) or any still unused password. Once used, the password is invalidated.
Limitations
Finite List
The number of executable operations is limited by the size of the list. When exhausted, a new list must be requested.
Physical Security
The list must be stored securely. Loss or theft renders all remaining passwords compromised.