2 ms·
TOTP is not 2FA though (depending on how you define 2FA). Something you know, something you have, something you are. TOTP is a seed that you know. Together w
by Ferret7446 3y ago
TOTP is not 2FA though (depending on how you define 2FA). Something you know, something you have, something you are. TOTP is a seed that you know. Together with your password which is also something that you know, you have one factor.
Also, if your password is 30 characters long, it sounds like you're using a single password for all of your services. Don't do that; you are 100% fucked if any one service you use gets compromised.
- Izkata 3y agoTOTP falls under "something you have" because the secret isn't transferred and you don't (generally) have access to it to leak it.
- Ferret7446 3y agoThe secret is literally transferred when you first set it up encoded in plaintext in a QR code, and then again, as I expect most here use a service like Authy. Unless you're using a device that already implements true 2FA like a Yubikey, it is generally trivial to pull out the seed (e.g., Google Authenticator app).