Using OTPs
As an additional layer of security, Keycloak allows you to use a second factor – or evidence – when authenticating users. In addition to providing a password – something users know – users are obligated to provide secondary evidence about their identity – something they have – which can be a code or a security key in their possession.
OTP is probably one of the most common ways to enable 2FA for user accounts. They are relatively easy to use and add an additional layer of security when you're authenticating users.
Although it's a useful method for 2FA, OTP has some disadvantages. It relies on a shared key between the server and users and does not provide the best usability for end users, while still open to common attacks such as phishing or scams. As we are going to see later, Keycloak helps you overcome these limitations by using a security device as a second factor using WebAuthn.
Note
As we will see in the...
