3 ms·
The main issue with TOTP is that it's still vulnerable to phishing, though it certainly is significantly better than SMS.
by zamalek 2y ago
The main issue with TOTP is that it's still vulnerable to phishing, though it certainly is significantly better than SMS.
- vlovich123 2y agoYes but as I said, I’m personally less concerned about a successful phishing attack. I can see why you might be concerned as an employee to a multi billion dollar business but attacks on my personal safe are unlikely to be sophisticated enough to fool me / I’m not a target for sophisticated ones. UX vs threat model tradeoff.
- tptacek 2y agoYou should be very concerned about phishing. The push towards modern phishing-resistant authentication was spurred from large scale studies of phishing success against very smart targets (security teams at Google, for instance). It's probably drastically less expensive to put a "sophisticated" phishing attack together than it is to target you with a memory corruption exploit.
- wglb 2y agoPhishing is the major vector for compromise. There is nobody that is unphishable. Very competent, careful, highly-skilled employees can be and have been phished.