[jay-barronville]

Huh? Sessions and TOTP aren’t mutually exclusive. In fact, they work quite well together.

And since when were cookies and sessions 1998-level technology? That’s ridiculous.

[eddsh1994]

Should they have said 1994-level? :P

[arcanemachiner]

I don't recall setting HttpOnly cookies in 1994...