I can understand that TOTP cannot be used for encryption.
But the app is asking for authentication. Zero-knowledge proof game might apply. Of course the local app must have the decrypted key in memory.
I wish we could defend against the Evil Maid...
The app is not asking for authentication, it's asking for encryption. Else an attacker could bypass the app's logic and read its data directly.
I can understand that TOTP cannot be used for encryption.
But the app is asking for authentication. Zero-knowledge proof game might apply. Of course the local app must have the decrypted key in memory.
I wish we could defend against the Evil Maid...