0 Boosts
0 Likes
@x_cli (I assume email-OTP is also less support hassle on the operator side, removes all the cases where a client has lost both seed and recovery codes... Feels like lazy "yes, we have MFA" checkbox-ticking nevertheless, and it's certainly less convenient to use when you have a password manager.)
@x_cli The only advantage of email-OTP is that the recipient is not in possession of the seed, which an attacker might have captured unnoticed.
In practice, that will probably make a difference only rarely - when an attacker has access to client credentials, the victim email account is likely compromised too.
Both are not (real-time) phishing-resistant either way.