Comment by alpineman
7 days ago
"If you accidentally leak your TOTP in a photograph of your desk"
So many security articles just seem to be so far removed from the real world. Like, when is that ever going to happen? It's the same principle that forces people to reset their password every month. Sounds secure in principle but then everyone just writes it down.
The reality is that Passkeys are way more convenient for most people. Reducing barriers to adoption is the best thing we can do to improve security.
> So many security articles just seem to be so far removed from the real world. Like, when is that ever going to happen?
Did you not read the previous paragraphs where they discussed someone leaking their password in a photo?
Yes. Leaking a password via a photo is completely different from leaking a 30-60 second TOTP.
Someone would need to:
1. Request the TOTP
2. Stand up and walk back
3. Take a photo of their desk with the TOTP visible
4. Send it to someone who can use it
All within 30-60 seconds. Just such an edge case it's not even worth thinking about.
[dead]