My bank, Google etc. use two factor systems where they send me a One Time Password via out of band means. e.g. SMS or an App on my Cellphone or a standalone RSA token generator.
This seems good except that it is vulnerable to a phishing attempt / rouge site that can get me to enter the OTP & then use it on the fly to get access.
I was wondering, would it be safer if the genuine log in page was supposed to also display a short, time-dependent reverse PIN that I could then match against a similar PIN on my out of channel device before I entered the real PIN on the website. Would that be a good way to verify that the site asking for the token is authentic?
Is this naive? Or would it improve things? If so, is it already being done by any sites / protocols?
PS. I think the secure fobs like FIDO U2F etc. do take care of this. But I am thinking of a way to secure a legacy SMS / Android app system that generates the 2nd factor.