3 ms·
TOTP is just as vulnerable to phishing as SMS. If you want phishing protection, use U2F.
by Buge 8y ago
TOTP is just as vulnerable to phishing as SMS.
If you want phishing protection, use U2F.
- jchw 8y agoYes that's true actually, it's U2F that actually fights phishing directly. I use TOTP integrated into my password manager, so it does partly fight phishing in that sense, since I can't accidentally enter it on the wrong domain. Though it is still worth considering SMS insecure due to the many other pitfalls that aren't phishing, where TOTP fairs a bit better. Still, I wish more stuff supported U2F.
- Buge 8y agoWhat password manager do you use that uses TOTP?
- jchw 8y ago1Password and Bitwarden support TOTP. Obviously, you lose the security of having two separate factors to compromise, but you gain the normal mechanical advantages of TOTP and a bit of extra phishing protection. I have a few YubiKeys as well, but yeah, less stuff supports that...
- Tepix 8y agoBesides the other two mentioned there's also Codebook.
- cyphar 8y agoKeePassXC supports TOTP, though it's still manual copy-paste (while the browser extension checks websites, and requests access from your KeePassXC session it doesn't support entering TOTP so you have to do it manually).