Yeah, though honestly I feel a deeper browser - password manager integration would already make it much safer (also an HTML standard for TOTP inputs is long overdue, although browser extensions generally do a good job at detecting it).
I never copy/paste the TOTP manually myself, the browser extension does it for me and it’s set up to verify that the domain name matches the intended TOTP entry, so it won’t add it if the URL is not the expected one.
That makes a lot of sense. And on the password manager, you have to click through the “use password on new website?” security dialog so often it becomes a nuisance warning and wouldn’t protect you from a phishing website, since you’re so used to clicking through it.
Phishing isn’t just over the phone. A phishing website that’s imitating say a bank website is just as easy to get the TOTP than it is the password.
Yeah, though honestly I feel a deeper browser - password manager integration would already make it much safer (also an HTML standard for TOTP inputs is long overdue, although browser extensions generally do a good job at detecting it).
I never copy/paste the TOTP manually myself, the browser extension does it for me and it’s set up to verify that the domain name matches the intended TOTP entry, so it won’t add it if the URL is not the expected one.
That makes a lot of sense. And on the password manager, you have to click through the “use password on new website?” security dialog so often it becomes a nuisance warning and wouldn’t protect you from a phishing website, since you’re so used to clicking through it.