It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds.
Would the login be more secure if two-factor authentication was enabled without TLS?
Using something like Google Authenticator and, knowing the keys are ephemeral the window for stealing the credentials would be about <30 seconds, correct? It seems a bit more secure but not by much. What are your thoughts?