I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token.
Common 2FA algorithms such as TOTP or HOTP use a secret as an input in order to generate a valid token. In my eyes local storage is not an option to persist the secret since there is no way to prevent access to the data through an XSS vulnerability. So how should I tackle this problem? What are the options?