2 ms·
It doesn't. Passwords (on the OS account and on the Blizzard account) mitigate against the machine being stolen. OTP mitigates against the password being stol
by jjnoakes 10y ago
It doesn't.
Passwords (on the OS account and on the Blizzard account) mitigate against the machine being stolen.
OTP mitigates against the password being stolen.
It is what you know and what you have so that if someone gets one they don't automatically get the other.
- scrollaway 10y agoAs an aside: The "What you know and what you have" paradigm is failing, imo. We often say passwords should be autogenerated, unguessable and unlearnable, stored in password safes like Keepassx. This removes "what you know" and you end up with "two things you have" (An OTP seed and a password in a safe). When both the password and the TOTP seed are on the same machine - assuming you autogenerated your password - they are both autogenerated and out of your sight so they really are just two things you have, and you have them in the same place. The difference is, it's impossible to capture the TOTP seed from the TOTP token being input - passwords are vulnerable to that. Am I crazy or does that make the password completely redundant?
- jjnoakes 10y agoIf you lock your password database with a long, secure password that you know, then you are still doing it "right". If your password database is not encrypted with a strong passphrase, then you are right, they both become "what you have".
- scrollaway 10y agoAh, that's true.