Re:Passwords Are Fine
by naniwaduni on Tuesday July 04, 2023 @12:29PM
(#36588938)
Realistically speaking, the vast majority of the security benefit of TOTP in the wild is "the user doesn't get to choose a weak password", followed by "the persistent secret isn't getting sent over the wire"; being an additional "factor" is faaaar in the distance.
[ Parent
| on HN ]
I think the advantage is that users suck at picking passwords, refuse to learn how to use a password manager, so TOTP is there to make sure that even if people set Welcome2023 as their password, some credential stuffer can't log in to their remote desktop because they need an extra six digits to log in.
You'll get the best security if you don't have the TOTP secret on a device that also contains your passwords, just in case you get hacked, but even with TOTP on-device it provides a little bonus security.