3 ms·
If you can phish the pw you can phish the totp. People type it in right after they type in the pw.
by jacobsenscott 4y ago
If you can phish the pw you can phish the totp. People type it in right after they type in the pw.
- TimWolla 4y agoYes, but the TOTP is only usable once and cannot be reused across unrelated sites ("password stuffing"). And with WebAuthn / U2F the second factor is completely unphishable.
- Conan_Kudo 4y agoYou cannot guarantee "completely unphishable", only that you cannot yet conceive of a way to do it. It's very dangerous to assume that something is completely secure.
- TimWolla 4y agoWebAuthn binds the credential to the domain. Under the assumption that your web browser and security key is operating according to spec this is unphishable. If your web browser or key contains a bug, or the domain is breached then all bets are off anyway.
- staticassertion 4y agoYes, but you can't guess a TOTP. You can guess a password. But I hope that Github will make their FIDO2 support better.
- Wowfunhappy 4y agoOnly if the user chooses a guessable password. If you really must protect the user from themself (which I don't think you should, except in much more extreme circumstances), you can generate the password for them.