alt Hacker NewsNo, the defining characteristic of a password is also how it is used: it is communicated in the clear to the verifier, thus revealing it to eavesdroppers. It is highly non-trivial to clone the knowledge in someone's brain if they never openly communicate the mTOTP secret but only do the computations in their head.
Replies
crote • yesterday at 11:43 AM
Not true. There are lots of authentication schemes where the plaintext password is never communicated. This becomes rather crucial when the client doesn't know for sure yet what the identity of the other side is. See for example wifi encryption.
Cloning the knowledge in someone's brain is fairly easy. You just need a wrench.
➕ show 1 reply
> No, the defining characteristic of a password is also how it is used: it is communicated in the clear to the verifier
This is only true if the verifier lives on your local terminal - otherwise we use an encrypted channel to transmit to the verifier, or do the exactly same type of timed-salted-hash scheme used here to transmit without revealing the password.