South African bank advises against the use of password managers

Re:South African bank advises against the use of password ma... by sp332 on Monday August 19, 2019 @11:02AM (#20738348)

Yeah that is a one-time code. It's in the name: https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... And again, if you use only this to log in, it's not two-factor authentication because it's only one factor. You'd have to combine it with something else (like a password or a fingerprint) to have two factors.

[ Parent | on HN ]

Re:South African bank advises against the use of password ma... by alkonaut on Monday August 19, 2019 @11:12AM (#20738439)

The rsa OTP-digit generator thing is an OTP, but what about signing with a device that doesn't generate a visible OTP? My authenticator app just asks me to produce my pin into the smartphone app and then the waiting transaction completes automatically in the computer web browser.

I suppose it could be an OTP too, but just not "manually entered"?

Is there a name for this type of authentication? It's just one factor but I do it on a separate device I mean.

[ Parent | on HN ]

Re:South African bank advises against the use of password ma... by sp332 on Monday August 19, 2019 @11:19AM (#20738513)

Oh I see. Yeah Microsoft's authenticator app can do that, but they use it as a second factor. I don't know the details but I'd guess that it's not time-based but some kind of challenge.

Another option is Tumblr's "magic link", where they email you a link that logs you in. That's one of the few places I've seen something like that used as a single factor.

[ Parent | on HN ]