3 ms·
A TOTP phone app is the same problem as SMS--my phone is the authenticator. It also provides a bunch of attack vectors like DDoSing my authenticator in order t
by bsder 3y ago
A TOTP phone app is the same problem as SMS--my phone is the authenticator.
It also provides a bunch of attack vectors like DDoSing my authenticator in order to get me to accidentally approve something.
And if my phone battery is dead, I can't log in.
And if my phone is stolen, I'm screwed.
None of these things improve MY security experience.
- russelg 3y agoThe main issue with SMS TOTP seems to be that phone numbers can be trivially stolen via social engineering, or less trivially via direct cell attacks. A TOTP app is effectively immune to both of these attacks. All your concerns are still quite valid however.