20 ms·
That really depends on your threat model. One reason to have multiple copies of the TOTP secret is to not be locked out of accounts should one lose their 2FA t
by jfim 6y ago
That really depends on your threat model.
One reason to have multiple copies of the TOTP secret is to not be locked out of accounts should one lose their 2FA token. For example, if one has two copies of the TOTP secret, one of which is in a secure location, and one of which is used for daily purposes, as long as the secure location is reasonably secure, it's not much different than storing backup codes in that secure location.
I do agree with you that having multiple copies of the TOTP secret that can be lost and not noticed isn't a good idea though.