3 ms·
Why couldn't we combine the two? Make TOTP based on a higher-entropy secret with longer generated codes the only factor. This would prevent replay attacks of en
by _Algernon_ 1y ago
Why couldn't we combine the two? Make TOTP based on a higher-entropy secret with longer generated codes the only factor. This would prevent replay attacks of entered passwords, thus protecting against phishing, and ensure users have safe secrets (since the site generates the secret).
- BlackFly 1y agoThat's my preference. For some things I would be willing to have the increased security of a genuinely separate device.