3 ms·

OTP. OTP, OTP, OTP. I could feel in my bones it was better, and now I have proof. Because you are giving an OTP to the website, instead of the website giving a

OTP. OTP, OTP, OTP. I could feel in my bones it was better, and now I have proof. Because you are giving an OTP to the website, instead of the website giving a push notification to you, OTP mitigates this. It's also just better and way less invasive. Google lets you use OTP, but only as a back-up option to having a phone and using push notifications. Apparently microsoft as well. Many financial institutions still use SMS for MFA, not wanting to use OTP or app probably because it's "too technical" for older people who comprise the lion's share of investors. PLEASE, can we all just use OTP already.

AlexandrB 5y ago
You used to be able to add OTP and then remove the SMS 2 factor from your Google account to have OTP-only. Is that no longer possible?
- SAI_Peregrinus 5y ago
  It is.
thatnerdyguy 5y ago
Isn't OTP vulnerable to MITM attacks?
- tialaramex 5y ago
  TOTP's big problems are: * It can be phished. An active phish persuades you this is Famous Bank, you enter the TOTP code, they relay it to the actual Famous Bank and steal your money. * Under the hood it's just a Shared Secret which means the Relying Party can lose all your credentials. You have no way to be sure they did a good job securing them, and they've got every reason to blame you if those credentials are stolen. * Psychologically humans perceive the TOTP code entry as mutually authenticating when it isn't. The site asked for my Famous Bank TOTP code, and it worked, so therefore this is actually Famous Bank. This actually makes them less cautious than they should be.
mk12 5y ago
Skip OTP, give us FIDO2/Webauthn for everything. OTP is vulnerable to phishing. I was pleasantly surprised when both Bank of America and Vanguard leapfrogged from SMS MFA to security keys. I bought 3 and started using them for every service that allows me to. Even better are services (e.g. Bitwarden, GitHub) that don't restrict to security keys, then MacBook Pro and iPhone Touch ID can be registered as well.

AlexandrB 5y ago

You used to be able to add OTP and then remove the SMS 2 factor from your Google account to have OTP-only. Is that no longer possible?

SAI_Peregrinus 5y ago
It is.

thatnerdyguy 5y ago

Isn't OTP vulnerable to MITM attacks?

tialaramex 5y ago
TOTP's big problems are: * It can be phished. An active phish persuades you this is Famous Bank, you enter the TOTP code, they relay it to the actual Famous Bank and steal your money. * Under the hood it's just a Shared Secret which means the Relying Party can lose all your credentials. You have no way to be sure they did a good job securing them, and they've got every reason to blame you if those credentials are stolen. * Psychologically humans perceive the TOTP code entry as mutually authenticating when it isn't. The site asked for my Famous Bank TOTP code, and it worked, so therefore this is actually Famous Bank. This actually makes them less cautious than they should be.

mk12 5y ago

Skip OTP, give us FIDO2/Webauthn for everything. OTP is vulnerable to phishing. I was pleasantly surprised when both Bank of America and Vanguard leapfrogged from SMS MFA to security keys. I bought 3 and started using them for every service that allows me to. Even better are services (e.g. Bitwarden, GitHub) that don't restrict to security keys, then MacBook Pro and iPhone Touch ID can be registered as well.