4 ms·
Losing a user password is a “bigger deal” when the password is re-used, I get this point. > Because the secrets have no intrinsic value This is too strong. In
by lll-o-lll 2y ago
Losing a user password is a “bigger deal” when the password is re-used, I get this point.
> Because the secrets have no intrinsic value
This is too strong. In general, it’s not possible to know my database has not been compromised. TOTP invalidation isn’t a trivial thing either, particularly if it was used instead of passwords and not as a 2nd factor.
- tptacek 2y agoI don't agree, but can you point to a system that uses TOTP as a sole factor?
- lll-o-lll 2y agoNot really (I can login to some systems with just TOTP, but TOTP was registered as a supplemental to something else). I guess your point is that having the seeds exposed is as big a deal as having salted hashes exposed. Which is to say, not a big deal. Fair enough.