TOTP
Time-based One-Time Password (RFC 6238). A six to eight digit code derived from a shared secret and the current time, used by authenticator apps. Phishable, so weaker than passkeys.
TOTP was a real improvement over SMS and is now the most common weak link in an otherwise modern stack, because a code a human reads and types can be relayed by a proxy in seconds. It also carries an enrollment problem: the shared secret is displayed as a QR code that can be screenshotted, backed up, and copied. Keep it as a fallback, not as the target state.
See also: MFA, HOTP, phishing-resistant MFA, passkey
Related on Start with Identity
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossaryMagic Link
A passwordless login where the user clicks a one-time link sent to their email. Simple to ship but inherits email security and deliverability limits, and is not
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- CVEZimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes
Zimbra Collaboration Suite, chained with CVE-2025-48700, was used to steal MFA backup codes and app passwords (CERT-UA UAC-0233). Added to CISA KEV in mid-March
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.