3 ms·
OTPs must be phished and then used very rapidly. The ROI for a successful phishing is much lower: a database of old OTPs is much less useful. (I'm sure you coul
by duaneb 10y ago
OTPs must be phished and then used very rapidly. The ROI for a successful phishing is much lower: a database of old OTPs is much less useful. (I'm sure you could use that to break the secret, but it's definitely not storing the secret.)
- mikecb 10y agoTrue, but not difficult.
- datguacdoh 10y agoOnly if you are using TOTP. If you're configured to use HOTP, then that phished credential is much more valuable.