3 ms·
>because the attacker can steal the TOTP secret key My question is why are we worrying so much about theft of the secret key? There are easier things to steal
by Thorrez 7y ago
>because the attacker can steal the TOTP secret key
My question is why are we worrying so much about theft of the secret key? There are easier things to steal and abuse (cookies, TOTP codes, website data). Those can be stolen even if the TOTP generator is a different device than the logging in device.
- susam 7y agoI agree that there are easier things to steal. However, that should not allow us to be lax with the security of the TOTP secret key. I think it still makes sense to worry about the theft of the TOTP secret itself. It's just an additional thing to protect along with cookies, TOTP codes, website data, etc.