[michaelt]

Sadly, the Secure Enclave doesn't support HMAC-SHA-1 or importing keys [1] so it's not compatible with the industry standard TOTP 2fa mechanism.

[1] https://developer.apple.com/documentation/security/certifica...

[monocasa]

I think we can do a lot better than the industry standard TOTP 2fa system anyway. TOTP involves sending plaintext private keys around during setup.

[amluto]

Fortunately, we have WebAuthn now. Hopefully Apple will jump on board soon.