Ask HN: Is using just a TOTP based authenticatation safe or a privacy issue

Re:Ask HN: Is using just a TOTP based authenticatation safe ... by pabs3 on Sunday April 03, 2022 @09:39PM (#30902570)

If the TOTP code is transferred via email, then it is less secure because email is usually transferred in the clear unencrypted. If the TOTP secret is transferred over encrypted http connections via QR code or similar to the user, so the TOTP codes can be generated locally on their phone or similar, then that is more secure.

You also have to make sure to generate and transmit recovery codes in case they lose their phone.

TOTP is also kind of annoying to use.

The best auth from a security PoV is Webauthn.

[ Parent | on HN ]

Re:Ask HN: Is using just a TOTP based authenticatation safe ... by ravenstine on Monday April 04, 2022 @06:52AM (#30905135)

> TOTP is also kind of annoying to use.

It should be offered, though, even if it's not the default.

I don't find it annoying to use at all, so long as my sessions can be sufficiently long-lived. It gets annoying when sessions end in a very short period of time, which I think can be potentially less secure because that creates more opportunities for authentication to be intercepted outside of HTTPS or for an exploit on an Authenticator-like app to be performed.

Just let me generate OTPs and stay logged in.

[ Parent | on HN ]