3 ms·
What if you just throw away the TOTP secret right after you get it and verify it on Github? You don't have to use your phone either. Just because you used TOTP
by leni536 8y ago
What if you just throw away the TOTP secret right after you get it and verify it on Github? You don't have to use your phone either. Just because you used TOTP to set up u2f on Github doesn't mean you have to store the TOTP secret indefinitely.
- fulafel 8y agoYes, I guess you could navigate it this way. But clearly this is not something Github wants users to do, so I wonder if this way is bad somehow. Maybe there is no backup mechanism to recover from u2f token loss other than the old 2fa mechanisms, for example.