Ricky Mondellormondello@hachyderm.io
Oct 12, 2026, 2:08 PMTOTP is a “great solution” for giving people some anxiety when the countdown to the next code generation is approaching. Beyond that tho, ¯\_(ツ)_/¯
Replies
Farty McFlycheapdozen@mastodon.socialOct 12, 2026, 2:14 PM@rmondello not to mention, to annoy them during that awkward period, when you’ll probably miss the end of the timer but it feels too long to wait for the next one.
Erik van StratenErikvanStraten@todon.nlOct 12, 2026, 2:42 PM@rmondello : a TOTP app is a stupid (see below) password manager that is not phishing-proof (because it does not check the domain name of the website where the code is entered).
Furhermore, backups of the database may be non-existent - and if they exist, most of the times they are highly insecure (there usually is no master password for encrypting the database). Without a backup, a lost, stolen or bricked phone means account-lockouts.
Also a lot of privacy-risks may exist because of commercial parties not securely storing backups on their servers (Twilio Authy anyone? Three years ago, may have improved: https://www.usenix.org/conference/usenixsecurity23/presentation/gilsenan).
Last but not least: TOTP password managers were introduced because people use (and reuse) extremely weak passwords - instead of teaching people to use a _decent_ password manager (and configure it securely, including let it only reveal web-passwords when visiting the site with the correct domain name, make backups etc).
Tom Harringtonatomicbird@mastodon.socialOct 12, 2026, 2:58 PM@rmondello it pretty much just works for me. Except when Apple’s password app fails to autofill the code, of course.
Oct 12, 2026, 8:06 PM@rmondello iirc, by spec server should also accept neighbour codes (±1 time interval), but probability that given website will act according to spec is about 50%
Mattmattdarveniza@mastodon.socialOct 12, 2026, 9:31 PM@rmondello ah yes, nothing better than getting users used to rushing into entering credentials under time pressure, can’t see how that could ever be misused 😅
Oct 13, 2026, 2:02 AM@rmondello I hate totp ugh hate it hate it. I’m sorry you’re having to defend your work against people who simply don’t or refuse to understand 🥲