Re:Ask HN: Is using just a TOTP based authenticatation safe ...
by ravenstine on Monday April 04, 2022 @06:52AM
(#30905135)
> TOTP is also kind of annoying to use.
It should be offered, though, even if it's not the default.
I don't find it annoying to use at all, so long as my sessions can be sufficiently long-lived. It gets annoying when sessions end in a very short period of time, which I think can be potentially less secure because that creates more opportunities for authentication to be intercepted outside of HTTPS or for an exploit on an Authenticator-like app to be performed.
It should be offered, though, even if it's not the default.
I don't find it annoying to use at all, so long as my sessions can be sufficiently long-lived. It gets annoying when sessions end in a very short period of time, which I think can be potentially less secure because that creates more opportunities for authentication to be intercepted outside of HTTPS or for an exploit on an Authenticator-like app to be performed.
Just let me generate OTPs and stay logged in.