3 ms·

"The basic idea is that instead of using a password to authenticate each user, a temporary secret code is sent to them over a secure channel. " Secure Channel,

by daraosn 13y ago

"The basic idea is that instead of using a password to authenticate each user, a temporary secret code is sent to them over a secure channel. " Secure Channel, like OpenSSL you mean?

anaphor 13y ago
No, you use a shared secret which both you and the server can use to generate a one-time password. You send the OTP (over something like TLS still, yeah) and the server checks that it is valid and makes sure it can't get replayed.
- daraosn 13y ago
  Forgot to add /s to my comment.
  - anaphor 13y ago
    Just to be clear, I wasn't disagreeing with you, I was disagreeing with the article. Their method over SSL/TLS is just as broken as you say.