3 ms·
Yes: to a first approximation, a second factor is something you are (or have), while a first factor is something you know. A second factor doesn't need to be un
by woodruffw 4y ago
Yes: to a first approximation, a second factor is something you are (or have), while a first factor is something you know. A second factor doesn't need to be unique, although uniqueness has separate benefits (especially when the unique factor is hard to clone or access physically).
TOTP isn't an ideal second factor, for most of the reasons above (combined with poor adherence to the standard, meaning that only the most basic subset of features tend to work). But is is still a second factor, unless you can do HMACs in your head :-)
- zokier 4y ago> Yes: to a first approximation, a second factor is something you are (or have), while a first factor is something you know. But the typical totp-in-password-manager setup is missing the other factor, there is nothing you know in such setup.
- tremon 4y agoIn that case, the thing you know would be the password to the password manager. But yes, I agree. I keep my TOTP on my phone (I use Aegis) and my password manager on my desktop computer.
- Xaiph_Rahci 4y ago> But is is still a second factor, unless you can do HMACs in your head Ok. Thanks for sharing your thoughts.