3 ms·
That's insightful. So you shouldn't only reset your passwords, but your TOTP setup too (if you set it up in this period). I think it's a flaw of TOTP though. T
by leni536 10y ago
That's insightful. So you shouldn't only reset your passwords, but your TOTP setup too (if you set it up in this period).
I think it's a flaw of TOTP though. The client secret should be client generated and should never leave the device.
- almost_usual 10y agoYes, unfortunately both the client and server need to have that shared private key to generate the same codes. Transmitting the key over a 'secondary' channel would have protected people here. It begs the question of whether or not TOTP is really 2FA if it is setup using a single channel of communication.