Hacker News new | ask | show | jobs
by navigate8310 16 days ago
Because those OTPs can be intercepted by any MITM unless you are using on-device 2FA generated by an app.
1 comments

> intercepted by any MITM

Most things are... even SSH is Trust-on-First-Use. You can really only verify out of band. OTP is quite a bit better than CC or bank account numbers... assuming the OTP is only restricting use (and not giving access to view or modify other account information, etc)