On: Stupid security things

[tsukikage]

This approach is geared at telephone banking. It means no single employee will learn the entire secret during a call. You generally have a regular password in addition to this step.

[OJFord → tsukikage]

Why can't I tell a bank employee a time-based 2FA code over the telephone?