3 ms·

Wouldn't a pilfered TOTP code be useless after five seconds anyway?

• jrockway 8y ago
  They tend to last for a minute, but 5 seconds is more than enough time for the phishing site to submit it and have it work. TOTP does not solve phishing in any meaningful way.
  • dawnerd 8y ago
    Wouldn’t it be invalidated if you submit it first?
    • jrockway 8y ago
      No, but why would you submit it? You are accidentally typing your credentials into Goggle.com or something, so you're only using them once.