2 ms·
The problem is now they know your TOTP secrets, they are only one password away from pretending to be you. And actually, they serve you emails, so password is
by jxy 3y ago
The problem is now they know your TOTP secrets, they are only one password away from pretending to be you.
And actually, they serve you emails, so password is moot for most of the sites today.
- koolba 3y agoThey always knew your TOTP secrets. The algorithm requires both parties to know the plaintext secret as it’s an input to the HMAC. It’s not a public key operation and they can’t store it as a hashed representation. It’s possible to have 2FA methods that are verify only (usually using public keys and signing), but TOTP is not one of them.
- MereInterest 3y agoThe website you log into with TOTP has always known the TOTP secret. Now, Google also knows your TOTP secret.
- koolba 3y agoAh! I misunderstood this being applied to non-Google accounts. Yes that’s scary.