3 ms·
In this case there is also a perceivable benefit for the user. SMS 2FA is vulnerable to sim swapping, this is not possible when TOTPs are delivered in-app. The
by bramhaag 1y ago
In this case there is also a perceivable benefit for the user. SMS 2FA is vulnerable to sim swapping, this is not possible when TOTPs are delivered in-app. The app is also FOSS [1], so even if you're paranoid you can still inspect what data is sent.
There are also just some things you cannot realistically do in the browser (or over SMS) without having to ship specialised hardware to 18 million people, like reading the NFC chip of your passport. This is needed for DigiD Substantieel and Hoog, which are mandated by the eIDAS regulations.
[1] https://github.com/MinBZK/woo-besluit-broncode-digid-app/ https://github.com/MinBZK/woo-besluit-broncode-digid-app/
- esseph 1y agoTOTP is able to be intercepted on the device.
- bramhaag 1y agoYes, and that's also true for SMS messages and your passwords. That is why having MFA is important.
- esseph 1y agoYou can't intercept a passkey in the same way. It is also far less likely to be phished, and there is nothing transmitted. TOTP is the modern WPA2 of security - it's just not good enough when better alternatives exist.
- lieuwex 1y agoWhat kind of risk profile does one have when it is likely that both the password is known and malware has been installed on the phone, but also just access to an ephemeral login session by the attacker (which could be obtained even when using a secure enclave by waiting for the user to authenticate by themselves) would not be enough?
- esseph 1y ago> password is known What password?