3 ms·
You are completely right, I misspoke (mistyped?) in my previous comment. Apologies for the error. What I referred to as U2F is TOTP as you say, and what I refe
by plaguepilled 4y ago
You are completely right, I misspoke (mistyped?) in my previous comment. Apologies for the error.
What I referred to as U2F is TOTP as you say, and what I referred to as TOTP is plaintext OTPs. That's an embarrassing mistake.
What I had meant to highlight is that SMS based authentication is more vulnerable than an authenticator app because the SMS exposes data that can be intercepted or collected by a third party. A timed algorithm solution does not expose this risk at read time (only when synchronising - unless I've missed something?), which is why I strongly prefer it.
- UncleMeat 4y agoThis is a modest but often overblown risk. SIM swapping is easy but scales badly. SMS interception malware exists but isn’t widely installed and you rely on the malware not being able to root your phone or get accessibility access to your screen. But most importantly, both TOTP and SMS are vulnerable to phishing - by far the most common method of stealing second factors.