Time-based one-time password (TOTP) algorithms and their advantages.

[rinata77]

I encountered this situation: I decided to set up two-factor authentication via one-time passwords (TOTP) on my phone, and everything seemed simple, but one time I accidentally reset the time settings, and I had to restore access manually. I wondered how reliable this algorithm is and how it helps with security if the time on the device gets lost. Has anyone encountered this? Maybe there is a way to protect against such cases?

[melissared]

Yes, this happens, especially if the device resets the time itself. In your case, using a separate device - hardware totp token, which does not depend on the phone settings, can help. I had a similar situation, and after that I switched to a token that works autonomously and is simply more convenient. Plus, they are not afraid of failures, and they are difficult to hack.

[tonybil]

I heard TOTP is very common among large companies. I wonder how effective it is against phishing attacks, when attackers try to find out passwords. I think it is worth reading more about it.