2 ms·
Then it's separate feature from TOTP. It's not a real 2fa because it works like service>duo>user where duo can accept anything for you.
by homakov 9y ago
Then it's separate feature from TOTP. It's not a real 2fa because it works like service>duo>user where duo can accept anything for you.
- Aissen 9y agoAgreed. I said "TOTP app" where I should have said "2FA app". I still think it's a second factor. Only a third party might have access to the factor too, like SMS codes/3DSecure.
- homakov 9y agoYeah it's a mess when you recommend duo/authy not clear TOTP or internal system. It's a second factor but not the one that's worth implementing: basic link to email has same security and costs $0
- rdslw 9y agoIts not that simple. Its true that push2factor have some disadvantages, but it has one really strong advantage above pure TOTP: phishing dosnt work as the 2factor is send directly to the site and cant be mitmed at your terminal. Read about it.
- homakov 9y agoWhat stops phishing? The attacker triggers push request, victim accepts - everything is the same?