Ask HN: Why do password managers have TOTP? • Hacker News Board

Re: Ask HN: Why do password managers have TOTP?

#121

Post by SahAssar » Mon, Apr 11, 2022, 5:08 PM UTC

daenz wrote: post #105

SahAssar wrote: post #58

I keep TOTP in my password manager, but my password manager is encrypted with a hardware key, a PIN code, and even getting the encrypted files depends on getting into my private git server. I also only use TOTP on sites that don't support u2f/fido/webauthn or implement it badly (like amazon that only allows a single key).

You can actually use multiple security keys on AWS I found out. It requires you to use the yubico authenticator app though. Essentially your security key stores the MFA secrets on it, and the yubico authenticator app accesses them for TOTP. You can register multiple keys in the authenticator app. So even though you can only have one MFA virtual device in AWS, that one virtual device is backed by multiple keys.

Then you don't get the strong phising protection though. One of the reasons U2F/webauthn is great at phising protection is that the key verifies the sites domain. IIRC there has only been one good attack against that and even that required the user to allow webUSB for the phising site (and it has been patched).

Re: Ask HN: Why do password managers have TOTP?

#122

Post by timwis » Mon, Apr 11, 2022, 6:38 PM UTC

happyopossum wrote: post #9

The whole thing you know. / thing you have is very outdated thinking. It made sense as a way to explain it 20+ years ago when 2fa was primarily done with physical RSA fobs, but it makes no sense in the modern world of TOTP, password managers, etc. For one thing, TOTP any it’s nature isn’t tied to a thing I have. Heck - you could build a TOTP token web service accessible from anywhere, it’s just an algorithm. Secondly…

Yes but you transmit the website password, so it’s possible for an attacker to gain access to that website through a data leak or through brute force, without gaining access to your password manager. Sure, they could do the same if they got hold of your TOTP secret, but that’s never transmitted (except at setup).

Re: Ask HN: Why do password managers have TOTP?

#123

Post by daenz » Mon, Apr 11, 2022, 7:58 PM UTC

SahAssar wrote: post #121

daenz wrote: post #105

Earlier quoted context omitted.

You can actually use multiple security keys on AWS I found out. It requires you to use the yubico authenticator app though. Essentially your security key stores the MFA secrets on it, and the yubico authenticator app accesses them for TOTP. You can register multiple keys in the authenticator app. So even though you can only have one MFA virtual device in AWS, that one virtual device is backed by multiple keys.

Then you don't get the strong phising protection though. One of the reasons U2F/webauthn is great at phising protection is that the key verifies the sites domain. IIRC there has only been one good attack against that and even that required the user to allow webUSB for the phising site (and it has been patched).

True. I can't think of any good reason why AWS limits MFA to one device...seems like a very silly oversight to be honest.

Re: Ask HN: Why do password managers have TOTP?

#124

Post by marc_abonce » Tue, Apr 12, 2022, 1:52 AM UTC

hsbauauvhabzb wrote: post #54

Side question: why is nobody losing their minds over the fact that almost all other MFA actions rely on your phone, which almost always has access to critical services (banking, work mail, personal mail, possibly ssh, etc). I’m more concerned about losing my Device as many MFA tokens are not backed up in apple ecosystem. The architecture is flawed for conveniences sake.

This is such a big frustration I have with phone based 2fa. It's obvious that the people that push for this are from the first world and have never been mugged or even worried about it.