Comment Comment by CyberRage It is not because:1. TOTP is time based, after 30 seconds it means absolutely nothing, you cannot recreate the 'secret key' from that number2. with TOTP everything is well-known. TOTP will usually generate a 6 digit 'secret', this makes managing it very predictable:6 digits = 1,000,000 options(including all zeros) we can easily calculate a good security marginlike: 5 attempt - 5/1,000,000 = 0.000005% chance of success Very predictable security marginfor passwords it's a huge unknown, it entirely depends on the user password quality parent CyberRage 3 years ago
1. TOTP is time based, after 30 seconds it means absolutely nothing, you cannot recreate the 'secret key' from that number
2. with TOTP everything is well-known. TOTP will usually generate a 6 digit 'secret', this makes managing it very predictable:
6 digits = 1,000,000 options(including all zeros) we can easily calculate a good security margin
like: 5 attempt - 5/1,000,000 = 0.000005% chance of success Very predictable security margin
for passwords it's a huge unknown, it entirely depends on the user password quality