3 ms·
They always knew your TOTP secrets. The algorithm requires both parties to know the plaintext secret as it’s an input to the HMAC. It’s not a public key operati
by koolba 4y ago
They always knew your TOTP secrets. The algorithm requires both parties to know the plaintext secret as it’s an input to the HMAC. It’s not a public key operation and they can’t store it as a hashed representation.
It’s possible to have 2FA methods that are verify only (usually using public keys and signing), but TOTP is not one of them.
- MereInterest 4y agoThe website you log into with TOTP has always known the TOTP secret. Now, Google also knows your TOTP secret.
- koolba 4y agoAh! I misunderstood this being applied to non-Google accounts. Yes that’s scary.