3 ms·
There's no reason a totp/otp needs to be read/typed in the clear - that's merely a convenient way to bridge trust from a phone to a desktop etc. The otp is pro
by e12e 5y ago
There's no reason a totp/otp needs to be read/typed in the clear - that's merely a convenient way to bridge trust from a phone to a desktop etc.
The otp is proof that you "possess" the otp secret.
Then again, it's a shared secret - so if the server side is compromised - all bets are off. Here client certificates/public key crypto does better.
- loteck 5y agoRight, the new factor is working fine, but instead of providing authentication, it's being used to merely attest to the validity of an additionally provided randomized knowledge factor, which is what gets actually for used for authentication.
- e12e 5y agoSo a hash of an image of a fingerprint isn't "something you have"? Leaves few things in that category then?