New answers tagged one-time-password
I agree that this is bad practice. You can make it better practice by scrambling the answers in one of many ways -- making questions about your father refer to your first car and vice versa, and so on, or giving false answers, or given IRRELEVANT answers (if you can remember what your irrelevant answers were), would discourage/prevent social engineering ...
First, this exists in practice in one form which isn't very secure: “security questions”. The second password is (if the security questions are used as intended) something that is easily memorable, but that is known by other people. There is no security reason not to have two passwords: one for daily use, and one (longer, non-memorable) for recovery. ...
Yes. Encrypt the plain-text TOTP key on the application side and save the cipher-text into the database. If you cannot trust the application either, use a HSM (hardware security module) or create and use a software version of it.
Top 50 recent answers are included