Time-based One-Time Passwords app (TOTP)
a method to manage your online security: multi-factor authentication (MFA), which is also sometimes called two-factor authentication (2FA)
OTP is a password (usually a set of digits rather than an actual word or phrase) that is valid only once.
time-based OTP is generated through an algorithm that computes a (usually) six-digit code by concatenating and scrambling the actual time in seconds and the numerical value from a “secret” or “seed.” A TOTP has a short life span, typically thirty seconds. It changes at the :00 mark and :30 mark of each minute.
Why not just let the bank (or whatever) send me an OTP via text or email?
--> The answer is that neither texting nor email is (or was designed to be) a secure method for delivering anything, much less passwords of any kind.
TOTP app on the market
- Raivo OTP
- backs up to iCloud, makes your TOTPs available on all your iOS devices
- requires a phone number for setup, not ideal for privacy concerns
- Authy make it really difficult to break away from its ecosystem, to the point of sometimes not allowing individuals to delete their Authy accounts
- ease of cross-device syncing—on Authy’s servers—so you can access your TOTPs on your various devices and OSs
- only provider that has full-fledged desktop apps as well as mobile apps
- Google Authenticator
- locked box, can not share TOTPs among multiple devices
- not recommended
- Microsoft Authenticator
- considered as a one-device-per-user app, not optimized for sharing TOTPs among multiple devices
- best suited only for Microsoft-heavy workplaces
- use only if you’re in a setting that requires Microsoft Authenticator, a proprietary kind of TOTP