Hi,<p>Is there a reason besides inertia why most applications that require authentication use a secret like a password for the primary factor, rather than using a OTP app?<p>For context about me: I am pretty new to programming, learning web application development. So maybe this would be a Very Bad Idea, and I just don't know why yet!<p>But it seems to me that some advantages of using a OTP would be:<p>1. It would be easier to temporarily grant someone else access to your account - as long as the app gives you a way to log out all other sessions and reauthenticate<p>2. It would remove the burden of remembering/managing unique passwords from the user
Otp apps require a device or a token. Requiring this removes the ability for a user to get in if their phone is dead, or lost. The support burden is also higher for a reset. Nothing is a show stopper, but also painful enough to prevent wider adoption.<p>Back in the old days you used to get single use passwords for secure system. This creates a similar problem, where loosing the sheet meant you needed new passwords.
An OTP falls into the "something you have" category[1] whereas passwords are in the "something you know" category.<p>Things you have are generally less convenient than things you know - which is why they're typically the 2nd factor, not the first factor.<p>[1] I'm assuming you need something to tell you the OTP - that you haven't memorized them all.
For example, there are 999999 combinations for TOTP. You might not be able to get through all those combinations in 30s but you could probably get through enough to give you a good chance of access on a long enough timeline.<p>So, you lock out IP addresses. The attackers move to using a botnet.<p>So, you lock out specific accesses to an account. The attackers can't move forward now but they can quite easily and cheaply deny access to a given account indefinitely.<p>So when implemented correctly, with a strong enough password policy and a way to introduce delay, i.e. with bcrypt2 and IP address locking, etc, 2FA makes it more difficult. The time to access is considerably longer for an attacker.<p>Of course, you've got similar problems with a password and a second TOTP but you've increased the difficulty level massively as the attacker must now have a working password before they can work on the 2FA dialog. At this point, you can easily spot suspicious behaviour and warn users, etc.
I think Okta can do (something like) this: <a href="https://help.okta.com/en/prod/Content/Topics/Security/mfa-factor-sequencing.htm" rel="nofollow">https://help.okta.com/en/prod/Content/Topics/Security/mfa-fa...</a>