> offtopic, is it secure to design a login that only requires username+TOTP? This elimilates passwords alltogether, but are there any pitfalls? Coincidentally

> offtopic, is it secure to design a login that only requires username+TOTP? This elimilates passwords alltogether, but are there any pitfalls? Coincidentally, I just mentioned that I did this: https://news.ycombinator.com/item?id=40878150 https://news.ycombinator.com/item?id=40878150 (of course, I leave it as a user preference: The user chooses whether to use standard passwords or to use one-time-passwords)