5 ms·
The first T in TOTP stands for “Time”. If a site used HOTP for their 2FA OTP, it wouldn’t work afaik as it’s counter based.
by stephenr 2y ago
The first T in TOTP stands for “Time”.
If a site used HOTP for their 2FA OTP, it wouldn’t work afaik as it’s counter based.
- keepamovin 2y agoDid know know that about TOTP! But as long as the counters increment at the same rate which presumably they would? For enrollment scan the same QR code for two different apps. Or is that not getting it?
- stephenr 2y agoI haven't used HOTP, but my (very basic) understanding is that it works by having both sides (the service and the OTP generator) increment a count. If you have two OTP generators configured, you'd have to "request" a new OTP from each of them every time you use one, to keep them in sync.
- keepamovin 2y agoMakes sense, thanks! I will look more into it. Thankfully, so far it seems my providers are not using it.
- stephenr 2y agoYeah, I've never seen it used for 2FA OTPS, but apparently it's used by some hardware tokens.
- keepamovin 2y agoAh, that's interesting! I Have never been able to figure those hardware tokens out. Sometimes when 2FA comes up I will click "Use your security key" thinking it is going to be a passkey/biometric or authenticator. Nope! It is some kind of USB stick that folks like Bloomberg traders use.