6 ms·
TOTP is designed to be usable even while offline.
by spacehunt 8y ago
TOTP is designed to be usable even while offline.
- Klathmon 8y agoBut is that trade off worth it? Is the ability to work offline worth giving up a simple prevention of phishing attacks?
- klodolph 8y agoFull circle here, since FIDO U2F has phishing-resistance like push notifications and lets you work offline like TOTP. "Offline" in the sense that everything besides whatever you're authenticating against can be offline.
- closeparen 8y agoPush notifications offer no phishing resistance. The attacker can present a fake login experience and conduct a real login behind the scenes at the same time. If you think you’re logging in, you’ll approve the push for them.
- deleted 8y ago[deleted]
- gowld 8y agoIf you are offline, how do you transmit the TOTP value-of-the-moment to the location where the protected resource is?
- guipsp 8y agoThat's the 'T' in 'TOTP': it's Time-Based (if the clocks aren't synced it doesn't work)
- baby 8y agoA push notification to help you open the app doesn't prevent the app being usable offline though.
- xhzkdnzhzjdkri 8y agoLord, I hope there aren't apps trying to use TOTP offline. TOTP works by using a shared secret between user and service. This secret and the current time are used to generate a code. All parties involved must have the secret (this isn't public key crypto). That means an app that can accept TOTP offline has the secret stored locally where it can be extracted.