3 ms·
TOTPs are also a defense against phishing leading to persistence. You can't phish someone and then lock them out of their account by changing their login detail
by rocqua 5y ago
TOTPs are also a defense against phishing leading to persistence.
You can't phish someone and then lock them out of their account by changing their login details.
Other second factors (like ubi-key) are better against phishing because they are cryptographically linked to the domain. This does require some form of challenge-response.
- hda111 5y agoI disagree on phishing protection. In the best case the phisher has 30 seconds to login, and then has enough time to change the login details.
- deleted 5y ago[deleted]
- rocqua 5y agoThe point is that changing login details often requires the 2FA. And I presume that a TOTP cannot be used twice.
- UncleMeat 5y agoI'm not sure this is a meaningful threat model. "Well, the adversary can authenticate as me but they'll have to reauthenticate to change my credentials so I'm a little bit safe" is a major stretch. You've already been pwned at that point and not a lot of services force a 2FA step on actions post-login.
- rocqua 5y agoMost services I have used actually did require 2fa on authentication relevant changes post login. That's why I mentioned this slight protection. I'll grant the threat model is of marginal relevance.