37 ms·
TOTP falls under "something you have" because the secret isn't transferred and you don't (generally) have access to it to leak it.
by Izkata 3y ago
TOTP falls under "something you have" because the secret isn't transferred and you don't (generally) have access to it to leak it.
- Ferret7446 3y agoThe secret is literally transferred when you first set it up encoded in plaintext in a QR code, and then again, as I expect most here use a service like Authy. Unless you're using a device that already implements true 2FA like a Yubikey, it is generally trivial to pull out the seed (e.g., Google Authenticator app).