Comment by lxgr

It's unfortunately full of half-truths which are not even necessary to make the point it's trying to make about attestation, so it's the opposite for me: Bad article, (somewhat) valid conclusion.

> TOTP is great, flexible, and keeps the user in control

TOTP is vulnerable to MITM attacks, so it's at best acceptable.