Great conversation! > Are you sure your extension cannot identify a QR code, identify that it is a valid seed for 2FA, and capture that information before the

Great conversation! > Are you sure your extension cannot identify a QR code, identify that it is a valid seed for 2FA, and capture that information before the page finishes rendering, before the malware would have a chance to 'see' it? I am sure that any browser extension cannot defeat malware running on the system. We have to assume that the malware is robust and sophisticated. If that is true, then it can monitor my browser and steal the secret directly from the web page as soon as the response comes in from the server. Regardless of how the secret is presented to the user (QR code, plain text, etc) and how 2FB changes the rendered page, there is no way that the malware wouldn't be able to also steal it in that same time frame if it's written correctly. > The new advice on memorised secrets is laid out in 5.1.1 and subsections[0], with important discussion and rationale in Appendix 1[1]. Gotcha. I literally downloaded this report last week and added it to my kindle along with a boatload of other 2FA related case studies, reports, and white papers. Lots of continued research reading to do. I'll keep an eye out for the section you highlighted. Great to hear that you might kick the tires on 2FB! It is still heavily under development, but getting closer to a dev preview release. If you haven't already, join the mailing list to get notified of releases: http://eepurl.com/c7OBwj http://eepurl.com/c7OBwj