TOTP tokens on my wrist with the smartest dumb watch

Re:TOTP tokens on my wrist with the smartest dumb watch by tzs on Tuesday October 18, 2022 @11:06AM (#33248379)

> TOTP is not much better than SMS-based 2FA. It's still vulnerable to phishing, local device malware (that attacks your TOTP in your password manager), etc.

It's still massively better than SMS-bases 2FA. Those vulnerabilities you list are all things that involve you or your device. You can take care to avoid them.

With SMS there are also vulnerabilities that don't involve you or your device, such as someone convincing your carrier to transfer your phone number to them.

[ Parent | on HN ]

Re:TOTP tokens on my wrist with the smartest dumb watch by UncleMeat on Tuesday October 18, 2022 @11:24AM (#33248744)

SIM swap is real but rare, since it cannot be automated. It is also largely defeated by having a strong and unique password, assuming that your provider doesn’t use SMS as a single factor password reset option.

If you’ve got a strong and unique password then your primary concern should be phishing, which is the same for sms and totp.

[ Parent | on HN ]

Re:TOTP tokens on my wrist with the smartest dumb watch by account42 on Wednesday October 19, 2022 @04:42AM (#33259294)

> assuming that your provider doesn’t use SMS as a single factor password reset option.

That's a big assumption and one that is far from generally true.

[ Parent | on HN ]