3 ms·
Not necessarily, it just has to not preclude a de facto standard solution. And it doesn't. The scheme described by OP above sounds fairly sane without compromis
by unimpressive 8y ago
Not necessarily, it just has to not preclude a de facto standard solution. And it doesn't. The scheme described by OP above sounds fairly sane without compromising the overall security of the system (in the way that e.g, password reset forms and security questions do).
- MrStonedOne 8y agoNo, its a shitty way of doing it that will never work in practice. Nobody will remember where those are. They will likely download the pdf, store it in downloads, where it will be used by some Trojan to hijack their account, or they will lose it during a device switch or some dataloss event. Telling people to store one time codes securely and reliably, for every single account they own, and telling them that will only work for the services that bothered to add that on to their implantation of the standard, works for techys, but not the overall populous.