4 ms·
"Oh no! Criminals are phishing our customers to get their passwords." Lets give them a code to enter... "On no! Criminals are phishing our customers to get th
by upofadown 5y ago
"Oh no! Criminals are phishing our customers to get their passwords."
Lets give them a code to enter...
"On no! Criminals are phishing our customers to get their code."
- hoofedear 5y agoWould a fix to this be to make OTP’s 10 seconds rather than 30? Or is that not feasible/doesn’t make a difference?
- lucb1e 5y agoJust run through the scenario you have in mind: would the attacker not be able to easily automate the forwarding of the OTP? Would grandmas still be able to use online banking? It's a trade-off, and validity periods so short that the user has to race a potential attacker, I don't think that's viable.
- jszymborski 5y agoIn all fairness, I see OTP/2FAs as more of a solution to credential stuffing than anything else.
- CyberRage 5y agoTOTP is definitely helpful vs phishing. They only last for 30 seconds, requiring better infrastructure(automated logins) which also tremendously helps with detection. The vast majority of phishing is just storing passwords for later attempts. TOTP by design can be stronger than password. the seed can be pseudo-randomly generated therefore you cannot guess the code without it, even if you have previously generated codes.
- deleted 5y ago[deleted]