New answers tagged


Goolge Authenticator, and the underlying TOTP concept, does not have backup codes. These are a different concept, provided by Google, alongside their TOTP implementation.


1Password has two modes it operates in, local and cloud mode. If you had the a local vault on one device, and another device had the authenticator, combining the two in one device is very likely to reduce security. If you had both the local vault and authenticator saved only on one device, the security is probably not improved. If someone has the ...


The problem with OTP authentication, is that human interaction is involved. You are supposed to first type your password, they type the second factor (or let the usb thing simulate a keyboard and type it for you). That is fine for web form authentication, where passwords are expected coming from a keyboard - in fact it even forces password managers to be ...


Because it is stored as a one-way hash - since Amazon know how long the OTP part, is they trim that off what you typed before generating the hashed version to compare with what they have stored.


The password is not hashed in the application but in the server. The server gets the password+OTP token in clear (protected with HTTPS between client and server) and can extract both password and OTP token from this, then proceed with normal password verification.


My opinion is that if all the data needed to compromise your systems exists in one place, that becomes a single point of compromise. It doesn’t completely negate all the benefits of 2FA, but a sophisticated attacker would have one-stop shopping to grab your generator’s key and state, as well as your passcodes and passwords. However, I am not the risk ...

Top 50 recent answers are included