Sophos XGS MFA OTP scan QR Code Loop

Hi VTH  Before we drill down this further, I just wanted to double-check are you using the same process for login (Step 5 & step 6) as per the below help section once the passcode is generated as per step No. 4?

docs.sophos.com/.../index.html

Ok, sorry I havent noticed that the passcode should follow the password.

Is there any information on how this works? It seems very unsecure because a mechanism must seperate the password and the passcode right?

Hi VTH Thanks for the update and I am glad the shared document steps helped you to fix the error. The passcode generated is based on TOTP Password Algorithm.

Can you please elaborate more on why it falls under an unsecured mechanism because of no separation of the password and the passcode? So that can help me to get more clarity on it and based on that, I can get back to you with the next update/research on it.

I can try:
I thought that the password I type into the login gets encrypted and then checked/matched against the password in the db. With the passcode included the encrypted message differs from the encrypted password in the db so there needs to be some extra seperation step to know what is the password and to know what is the 6 digit passcode.

With an extra textfield for the 6 digit passcode the password and the passcode would get encrypted independet from each other and checked against the db an the authenticator app seperatly. Merging this together seems like a bad move.

Thanks for sharing the above information, Do you have any reference guidelines or documents where you came across and got the above details that suggest that combining password and passcode is not the best practice and should be avoided or to get dept info for the loopholes in this kind of combined integration? The intention is before I represent or raise internally I wanted to understand this fully.

Thanks for sharing the above information, Do you have any reference guidelines or documents where you came across and got the above details that suggest that combining password and passcode is not the best practice and should be avoided or to get dept info for the loopholes in this kind of combined integration? The intention is before I represent or raise internally I wanted to understand this fully.