Topic Technology
Authenticator apps (TOTP)
Apps that generate time-based one-time codes from a shared secret, or that approve sign-ins by push notification.
Also called: TOTP, Google Authenticator, time-based codes, push MFA
- Official site
- rfc-editor.org
Questions (1) #
- What is phishing-resistant MFA?Identity
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site.
Comparisons (2) #
Glossary #
- MFA fatigue (push bombing)
- An attack on push-notification MFA in which the attacker, already holding the password, triggers repeated approval prompts until the user accepts one. Number matching, where the user types a number shown on the login screen, reduces it.
- TOTP
- Time-based one-time password: a code computed by an authenticator app from a secret shared at enrollment and the current time, defined in IETF RFC 6238. It is never sent over a network, but it can still be phished.