Post by @mjg59@nondeterministic.computer

2026-07-12 12:55 UTC

@nowster @psf@oldbytes.space different scenarios can have different outcomes, yes (but yes, this is a good reason for not using TOTP as a second factor - using actual cryptography provides much stronger benefits)

Replies (2)

@mjg59@nondeterministic.computer 2026-07-12 13:29

@nowster @psf@oldbytes.space I think the main counter is that a bunch of companies doing 2FA without asymmetric crypto are using a third party vendor for the 2FA part, and in that case the TOTP secrets are in a separate security domain to the passwords

Open ##4536232
@psf@oldbytes.space 2026-07-12 17:03

My general point is that 2fa intends to help with the hop between the user and the service provider, but doesn't help with other hops, and nowadays those tend to be the weakest links. The number of times I've suffered a security incident due to a weak password or getting phished is zero. The number of times I've suffered a security incident due to my service provider getting popped is... well I've lost count. Meanwhile every service provider treats me like a stone age heathen for eschewing 2fa, and increasingly I'm not even offered the choice. That's victim blaming. @mjg59@nondeterministic.computer if by "actual cryptography" you're talking about something like homomorphic encryption that allows service providers to process my data without understanding it, that'd address my concern, but I am not sure entirely what you mean.

Open ##4536233