News for hackers. Stuff that matters.

A comment on Why even let users set their own passwords?. Parent comment

Re:Why even let users set their own passwords? by jiveturkey on Saturday July 22, 2023 @03:20PM (#36828965)
you missed the attack. a keylogger doesn’t capture the TOTP (and fully synchronous 0-reuse TOTP isn’t possible on global scale, instead you catch it in audit) a keylogger captures the master password to the pwm that stores the TOTP secret.
[ Parent | on HN ]
Re:Why even let users set their own passwords? by r00fus on Saturday July 22, 2023 @06:16PM (#36830495)
But then they have to have physical access to your pwm or an export of it. If it's cloud-based, I'd have to assume there's some additional auth done for non-approved devices, or it's a bad cloud pwm.
[ Parent | on HN ]