3 ms·
The "point" of U2F instead of HOTP/TOTP is that the code you send to evilhacker.com can't be used on google.com - so getting a usable token by phishing is impos
by vertex-four 9y ago
The "point" of U2F instead of HOTP/TOTP is that the code you send to evilhacker.com can't be used on google.com - so getting a usable token by phishing is impossible. HOTP/TOTP are flawed in that you can send the generated code to evilhacker.com and they can use it to log in to google.com with you being none the wiser.