4 ms·
> With standard TOTP, now they have to worry about if the user correctly added the secret The standard flow I usually see for setting up TOTP ends with enterin
by Zak 1y ago
> With standard TOTP, now they have to worry about if the user correctly added the secret
The standard flow I usually see for setting up TOTP ends with entering an authentication code. If it's not valid then the setup isn't finished.
- xienze 1y agoThat's not what I'm talking about. I'm talking about the act of adding the secret to the authenticator app in the first place. There needs to be documentation to the effect of "open Google Authenticator, and if you don't have it, download it on the App Store or Google Play store. Open the app and choose 'new secret', ...". Probably also put in a QR code and link for good measure. Rinse and repeat for all the major authenticator apps. THEN you can have them verify. It adds up to a decent amount of supporting documentation that the bank is responsible for providing.
- Zak 1y agoOutside of services like Github where the average user is expected to know what an RFC is, I usually just see Google Authenticator supported and no mention of the fact that alternatives exist. That seems like an adequate solution.