171
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 Sep 2023
171 points (94.8% liked)
Technology
34879 readers
45 users here now
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
founded 5 years ago
MODERATORS
I think it’s because TOTP requires some sort of initial token sync that is more complicated than entering a telephone number. There’s also no need to have people backup codes etc. To use Authy for example I need to photograph a QR code and have a smart phone.
Text message as a solution works on older non-smart phones so it’s possibly the “most widely accessible” solution.
From a backend perspective as well it’s just an API text $random to $phone.
TOTP is much easier to implement on the backend. No API required, just generate a few codes yourself and check if the user gave you one of them (multiple codes to provide a time window).
You have to configure the users device at the start to give you your own codes back…
That’s just a secret, like a password. If you can save their password, you can save their TOTP secret. For the user, they just scan a QR code with their app. They don’t even have to type the code in.