4 ms·
>Generally the threat model that TOTP protects against is not someone breaking into your device. And yet, in some realistic scenarios TOTP does protect me agai
by fauigerzigerk 3y ago
>Generally the threat model that TOTP protects against is not someone breaking into your device.
And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.
- lamontcg 3y agoNot if I'm on your device and hijacking your already-authenticated connection. I just need to be careful enough to do it in the background in such a way that you don't notice.
- fauigerzigerk 3y agoIf my device got stolen I would remove the device from my accounts immediately. And without the second factor you wouldn't be able to do anything about it.
- lamontcg 3y agoThe threat is that your device is infiltrated right now.