> The user can enter the offline-generated secret into that false origin and never realize the phishing even happened. That's pretty far-fetched, never heard o

> The user can enter the offline-generated secret into that false origin and never realize the phishing even happened. That's pretty far-fetched, never heard of a phishing attack that tricked the TOTP secret from users. I bet 99.99% of TOTP users don't even have access to the secret. You can only trick the six digit code out of them, valid for 30 seconds, which you then feed into the actual login form / API. The SMS code phishing flow is the same. You trick the username and password out of the user, feed it into the actual login form, trigger the SMS challenge, and once again trick the six digit code from the user (which is usually valid for longer than 30 seconds, btw). Except with SMS there are many ways to intercept. Re edit: “Your downvoting suggests there's a significant difference between the two, but phishing studies show that all of us, even those of us who consider ourselves experts, are vulnerable to phishing.” With SMS you don’t even need phishing, you can combine leaked credentials (e.g. from other breaches) and SIM jacking to hijack accounts. Plenty of high profile cases posted here before. That’s the scary part: no phishing at all. And you never backed up the “TOTP is the one that is more trivially MITMed” claim.