5 ms·
Totp seeds leak from servers just as easily as passwords do.
by lll-o-lll 4y ago
Totp seeds leak from servers just as easily as passwords do.
- computerfriend 4y agoOne way passwords leak from servers is when they're being inappropriately logged (like at the POST-level), which is not going to happen for TOTP seeds.
- lll-o-lll 4y agoTrue enough. However, unlike a password, you can’t take a hash of it and thus reduce the consequence of exposure. It’s just another shared secret, albeit one that doesn’t rely on the fallibility of human creation. The only good solution is WebAuthn and related technologies (phone passkeys for disaster recovery), so that server side needs nothing more than a public key.