This makes it harder to capture on a compromised network. Indeed, when Dropbox first introduced TOTP on their services, they spelled out their reasons as helping protect users who were reusing passwords.Īfter the uniqueness and unguessability of the long term secrets, the next most important benefit (for most people) is that the long term secret isn't transmitted. In most cases where TOTP is deployed, it is done so because of properties #2 (unguessability) and #3 (uniqueness). And you put the long term secret on "something you have", if for some reason that is important to you.
Again, this is unlike typical password use, where people reuse passwords. You will not end up reusing the same TOTP long term secret across various services. Again, this is unlike typical password use with human created passwords. The long term secret is generated by the server when you first enroll, and so it is generated up to the service's standards of randomness. This also means that the long term secret can't be phished (although the numeric codes can be.) (This is unlike typical password usage where the password is transmitted over the net, and so depends on other protections, such as TLS). The long term secret is not transmitted when it is actually used. With TOTP get a long term secret that is only transmitted (typically the QR code), when you enroll.
Long term secret isn't transmitted during authentication. So I am going to list a few of the security properties you get with TOTP and contrast them with typical password use. Security benefits of TOTP (contrasted with typical password use)
Don't get led astray that this all goes under the term "2FA", as if that is the only security benefit you get from these schemes. The "second factorness" of TOTP one of several security properties it offers, and it may be the least important in many cases. The answer depends on what security properties you actually want from time-based one time passwords (TOTP). I work for 1Password, and I wrote exactly about this question when we introduced the feature.
0 kommentar(er)
