Re:Two million Facebook, Gmail and Twitter passwords stolen
by XorNot on Thursday December 05, 2013 @07:03AM
(#6853966)
More like the OTP token would be on my smartphone or some other device, so I can generate passwords as needed that are guaranteed to be unique.
But they don't require my normal password to be entered at all. I'd accept punching in my real password or a code on my phone to generate the smart token, since the time required to brute force something like that would be give me plenty of time to revoke it's authorization.
Re:Two million Facebook, Gmail and Twitter passwords stolen
by Zecc on Friday December 06, 2013 @04:32AM
(#6860264)
Ah sure, as long as both the client and the server are in agreement of what the next token should be then everything is fine. I didn't think this through.
But they don't require my normal password to be entered at all. I'd accept punching in my real password or a code on my phone to generate the smart token, since the time required to brute force something like that would be give me plenty of time to revoke it's authorization.