Comment on Passwords are obsoleteparentComments−anaphor12yNo, you use a shared secret which both you and the server can use to generate a one-time password. You send the OTP (over something like TLS still, yeah) and the server checks that it is valid and makes sure it can't get replayed.−daraosn12yForgot to add /s to my comment.−anaphor12yJust to be clear, I wasn't disagreeing with you, I was disagreeing with the article. Their method over SSL/TLS is just as broken as you say.
Comments
No, you use a shared secret which both you and the server can use to generate a one-time password. You send the OTP (over something like TLS still, yeah) and the server checks that it is valid and makes sure it can't get replayed.
Forgot to add /s to my comment.
Just to be clear, I wasn't disagreeing with you, I was disagreeing with the article. Their method over SSL/TLS is just as broken as you say.