3 ms·
Check this[] starting at 18:55. It explains the issue and the fix for OTP/TOTP. What you need is a u2f device/key/app and web auth. It takes the responsibility
by thefounder 7y ago
Check this[] starting at 18:55. It explains the issue and the fix for OTP/TOTP.
What you need is a u2f device/key/app and web auth. It takes the responsibility to identify if the website is fake or not from you which is really the core issue. The secret is negotiated directly with the u2F device/sec key.
https://m.youtube.com/watch?v=kGGMgEfSzMw&time_continue=1271 https://m.youtube.com/watch?v=kGGMgEfSzMw&time_continue=1271