Login and OTP only

[spiderik]

Guys, can't you just switch off password auth for users using steamguard OTP? It makes absolutely no sense to ask for password, then disregarding the correct password entered, requesting the OTP form SG app. Every other VPN (commercial companies access) need just OTP when deployed.
Enter username
Enter OTP

Exactly one step less, means 1/3 of steps needed. I have my password for Steam saved in my browsers cache since I am using SG. Security "zero" anyway. Just driving me nuts to search for the pass in my browsers saved passwords, when my client restarts or gets disco and needs reauth.

[ KARR™]

Originally posted by spiderik:

Every other VPN (commercial companies access) need just OTP when deployed.
Enter username
Enter OTP

May want to re-think your definition of "every".

I need to:

Enter username
Enter password
Enter PIN
Enter time-sensitive code

...and to think about it, just about every system i have ever seen that uses some form of key or one time code needs them too.

[spiderik]

hmm ok, redefined to "every one I use" then :) When the ones I connect to introduced OTP keys (HW keys and some OTP software bundles too) the password there is just for "I do not have possibility to use my OTP token" cases. 3 telco customers, 2 enterprise.