Hacker News new | ask | show | jobs
by jrochkind1 1510 days ago
I don't understand enough about the protocol to judge your claim, but it's challenging my assumptions about what 2FA is for. If 2FA with TOTP does not protect you in cases where the attacker knows your password... what is it for? I thought that's what it was for.
1 comments
bigDinosaur 1510 days ago
The server also contains the secret, so if that secret is leaked then the attacker can generate new tokens. It protects you in the case that your password was stolen, but nothing else e.g. via phishing.
link
jrochkind1 1510 days ago
OH, I see, thanks. The password and TOTP secret are separate, but you're suggesting they may likely both be stored in the same place such that a breach could give attacker access to both. Tell me if I don't have it right.

It occurs to me that I know how to reset my password most places I log in to, but I actually have no idea how to reset the TOTP secret.

link
bigDinosaur 1510 days ago
It might be stored separately, the issue is just with an uncontained breach I suppose.
link