Comment on Passwords are obsoleteComments−daraosn12y"The basic idea is that instead of using a password to authenticate each user, a temporary secret code is sent to them over a secure channel. "Secure Channel, like OpenSSL you mean?−anaphor12yNo, you use a shared secret which both you and the server can use to generate a one-time password. You send the OTP (over something like TLS still, yeah) and the server checks that it is valid and makes sure it can't get replayed.−daraosn12yForgot to add /s to my comment.−anaphor12yJust to be clear, I wasn't disagreeing with you, I was disagreeing with the article. Their method over SSL/TLS is just as broken as you say.
Comments
"The basic idea is that instead of using a password to authenticate each user, a temporary secret code is sent to them over a secure channel. "
Secure Channel, like OpenSSL you mean?
No, you use a shared secret which both you and the server can use to generate a one-time password. You send the OTP (over something like TLS still, yeah) and the server checks that it is valid and makes sure it can't get replayed.
Forgot to add /s to my comment.
Just to be clear, I wasn't disagreeing with you, I was disagreeing with the article. Their method over SSL/TLS is just as broken as you say.