3 ms·
I"m not seeing a huge benefit of the personal device being offline, while you're trying to log into an online service. But let's say there was a need for that,
by overeater 4y ago
I"m not seeing a huge benefit of the personal device being offline, while you're trying to log into an online service. But let's say there was a need for that, what about using bluetooth or wifi direct to push to the device?
- jaywalk 4y agoWhy? We've already got better standards, there's no need to add complexity to TOTP.
- t0astbread 4y agoLike I said, I don't know the standards, so I don't know the authors' intentions. But there are actually specialized devices which do nothing but generate TOTP tokens, so that seems to be a use case. (The keys don't have to be on a phone or in a particular app.)
- unethical_ban 4y agoA push token usually means you're utilizing a service such as Okta, RSA, Symantec VIP, etc. whereas RFC TOTP can just be managed locally and the user can choose a 2FA app of their liking.