Hacker News new | ask | show | jobs
by WorldMaker 1465 days ago
For now it is mostly just that "pull-based" TOTP is cheaper/easier and works in more "offline" or "partially-disconnected" scenarios. Your phone and the website only have to directly "communicate" once: that QR code to bootstrap the secret key. After that all of the math is independent: the math to generate codes is done entirely on the phone and the math to verify it is done entirely on the website.

There is a growing support for "Push" style authorization tools that more directly communicate between the devices. Up to now the tools have been mostly vendor-specific. Google has push notification authorization in the Google ecosystem. Apple has push notification authorization in the Apple ecosystem. Microsoft has push notification authorization the Microsoft ecosystem. The growing WebAuthn standards (for which the linked post is a Guide to working with them) are exactly the sorts of standards that are being built to increase inter-operability between vendors and trying to make "push" style authorization cheaper/easier/more ubiquitous on the web. (Those standards aren't 100% there yet for multi-vendor interoperability as other comments in these threads accurately nitpick, but this is still a giant step forward in that direction.)

Also, if your TOTP Authenticator app isn't already using your device's fingerprint or Face ID biometric locks, consider moving to a TOTP app that does. Most of the major ones do, exactly for that "trifecta" reason of layered security.