Guide to Web Authentication

Re:Guide to Web Authentication by overeater on Wednesday June 22, 2022 @02:21PM (#31839837)

I"m not seeing a huge benefit of the personal device being offline, while you're trying to log into an online service. But let's say there was a need for that, what about using bluetooth or wifi direct to push to the device?

[ Parent | on HN ]

Re:Guide to Web Authentication by t0astbread on Wednesday June 22, 2022 @03:21PM (#31840613)

Like I said, I don't know the standards, so I don't know the authors' intentions. But there are actually specialized devices which do nothing but generate TOTP tokens, so that seems to be a use case. (The keys don't have to be on a phone or in a particular app.)

[ Parent | on HN ]

Re:Guide to Web Authentication by unethical_ban on Wednesday June 22, 2022 @07:57PM (#31843441)

A push token usually means you're utilizing a service such as Okta, RSA, Symantec VIP, etc. whereas RFC TOTP can just be managed locally and the user can choose a 2FA app of their liking.

[ Parent | on HN ]

Re:Guide to Web Authentication by jaywalk on Wednesday June 22, 2022 @02:33PM (#31839957)

Why? We've already got better standards, there's no need to add complexity to TOTP.

[ Parent | on HN ]