Szilárd Pfeiffer - TOTP is not a Silver Bullet

## Overview Szilárd Pfeiffer challenges the belief that enabling TOTP solves authentication, drawing on decades of crypto work including the D-Heat Attack and Cryptolizer.

## Limitations of TOTP TOTP is not a true second factor when login and code generation happen on the same compromised mobile device. Short code lifetimes provide natural rate limiting, but clock skew forces servers to accept previous, current, and next time windows—widening attack surface.

## Implementation Pitfalls He surveyed popular providers: roughly 25% use validity windows under 120 seconds contrary to RFC guidance. Lower digit counts (e.g., four digits) ease brute force. Eight-digit codes reduce usability.

## Takeaways TOTP improves security only with sound deployment—separate factors, conservative time windows, and awareness that client-side secret storage on phones remains a weak point.