4 ms·
Implementing it in software is theoretically possible, but not recommended as it would be extremely liable to attack
by albertgoeswoof 4y ago
Implementing it in software is theoretically possible, but not recommended as it would be extremely liable to attack
- 3np 4y agoIndeed, which is most likely the biggest reason why a ready-to-use solution doesn't exist : it's not really a common use-case due to the security implications. Still, if compared to a local software TOTP, it's not necessarily a step down.
- lrvick 4y agoIf you have malware on your system it will just take your post-login cookies and you are already hosed. A software WebAuthn solution stops the most common threat that TOTP misses: phishing. Even software WebAuthn is better security than TOTP in every way, especially if it takes the QubesOS approach of running it in a dedicated offline VM.