this post was submitted on 14 Oct 2026
129 points (74.7% liked)
Privacy
51450 readers
371 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If (after decades of awareness) you manage to get phished while using TOTP, you shouldn't be trusted with a phone or any digital information at all
Granted. But there are plenty of users who probably shouldn't be trusted with any digital accounts, but they still have to use them for daily life. If we can make it harder for them to mess up we should.
The problem is that if they're getting phished with TOTPs then they'll walk through a scammer over the phone to let them access their accounts other ways.
You can put all the security in place all you want but 99% of breaches aren't coming from red team actors "hacking" into a system. It's way easier (and even moreso now with LLMs able to do robo calls with human sounding voices) and get Brian from accounting to give up his shit...or even the CEO to give up his.
I've seen it all, they willfully will give over their access because they're dumb as fuck.
Can we Not Act like only idiots can get phished? Nobody is Safe, especially when the phishing attempt is incredibly convincing
Most of the people who get phished, are not educated enough to avoid it. They don't want to be, because computers are just supposed to work and not be something they need to learn.
If you're educated and ask questions vs just assuming everything is legit and giving away everything they ask for then you realize quickly that phishing is not as convincing as you're making it out to be.
Phished doesn’t mean just a plain old phone call or email these days. It can still happen, and does. But there are now reverse proxy systems that clone legit web pages to steal TOTP by appearing legit, and they’re highly successful.
I didn't know of this, I still prefer the control TOTP gives you but yeah, that makes an argument for the passkeys I guess.
I know someone who works at a fairly large public university where TOTP is required. People (mostly students) are still constantly getting phished, despite TOTP. I guess young people don't have the decades of awareness that some of us have.
TOTP tokens are often distributed as QR codes, where you can store in more than one place, store/copy/transfer in plaintext between people or places. Compromise of that token gives permanent access to all TOTP codes generated.
I'm not a fan of how most TOTP apps and implementations actually work right now.