Authenticators that require the manual entry of an authenticator output, for example out-of-band and OTP authenticators, SHALL NOT be considered verifier impersonation-resistant because the handbook entry does not bind the authenticator output to the specific session getting authenticated.Th… Read More