5 ms·

I just tried one of the apps and it had instant feedback when I gave it the wrong 2FA code. It felt too fast for any network calls to be involved. I looked at t

I just tried one of the apps and it had instant feedback when I gave it the wrong 2FA code. It felt too fast for any network calls to be involved. I looked at the network tab in my browser and sure enough no network calls were being made. It looks like they are using some sort of client side crypto to verify or at least reject tokens. Does anyone any idea about why they'd chose to do it client side or what I am missing?

trhaynes 5y ago
https://en.wikipedia.org/wiki/Time-based_One-Time_Password https://en.wikipedia.org/wiki/Time-based_One-Time_Password
- owaislone 5y ago
  Doesn't that mean the client holds the keys/secret of some sort is shared with the client so it can either generate or verify?
  - mfollert 5y ago
    you only need the pub key to verify