3 ms·
How? TOTP does not embed the domain, as it is generated on a separate device which does not communicate with your browser, and does not know the target domain.
by madars 5y ago
How? TOTP does not embed the domain, as it is generated on a separate device which does not communicate with your browser, and does not know the target domain. TOTP is literally HMAC(shared-secret, time-interval) mapped to a short range (e.g. mod 10^6).
- encryptluks2 5y ago> it is generated on a separate device which does not communicate with your browser, and does not know the target domain. No, not always and many password manager solutions do integrate with your browser and know the domain for the password.
- madars 5y agoThen that's not TOTP https://datatracker.ietf.org/doc/html/rfc6238 https://datatracker.ietf.org/doc/html/rfc6238 but something different. Do you know how it is called and which products support it? I'd love to read up about it!
- encryptluks2 5y agoYes, it is TOTP: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
- valid_username 5y agoBitwarden has TOTP support in paid plan. And it works with browser extension which recognises domains.
- AkshitGarg 5y agoIt certainly recognizes the domain, but thats more of a convenience feature than a security feature. Nothing is stopping you from putting your example.com code into legit-example.com manually. Sure the extension won't do it automatically, but if the user is convinced to put the password into the fake website, user could also put in the TOTP code
- lemoncucumber 5y agoMy password manager only fills passwords on the domain they belong to, and it’s also my TOTP generator so the same applies there too.