As a Brit of a certain age, I hate the term TOTP in this context, as it will always mean to me 'Top of The Pops'[1] ;)
---
Ask HN: Why do password managers have TOTP?
91–100 of 124 posts
Re: Ask HN: Why do password managers have TOTP?
#92Earlier quoted context omitted.
The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these should be different things.
I disagree that storing these separately is “the whole point of MFA”. Passwords can be hacked in a number of places, not just client side or in the password manager, so TOTP mitigates MITM style attacks where the password is known by an attacker but it was not gained from the password manager or the site. I certainly get that separating them would be theoretically better, but with TOTP in my password manager I end up…
Good point. I'd agree that totp on phone > totp in pw manager > no totp, so using it in some capacity is definitely better than not using it at all.
Re: Ask HN: Why do password managers have TOTP?
#93Earlier quoted context omitted.
I think that auto-suggest, meaning the password manager only suggests a password, but you need to actively click on the suggestion in order for the password to be entered, would satisfy both requirements: mitigate phishing and exfiltration. This is the default for 1password.
This is also the case for bitwarden. I think it's only browser built in autofill that does it proactively
Bitwarden has an auto fill option, though it was off by default last I checked. LastPass too has auto fill yet mitigated by requiring a click to populate the match.
Re: Ask HN: Why do password managers have TOTP?
#94Short answer: Password managers offer this funcionality because there is a demand for it. Long answer: In practice, TOTP schemes are used (from a webadmin point of view) just to stop credential stuffing attacks [1]. There is very little additional security in generating TOTPs on a dedicated device, such as a smartphone, compared to generating them on the password manager itself. Threat models in which a separate setu…
If your password store is owned then the attacker has both your credentials and the second factor. So in that way, the password manager has sacrificed a security fail-safe.
If your password store is owned, you’re fucked. Period.
2FA will offer little failsafe in such a scenario.
Re: Ask HN: Why do password managers have TOTP?
#95If it was on a different app on the same device, it still wouldn't be the 2FA you're talking about.
Re: Ask HN: Why do password managers have TOTP?
#96Earlier quoted context omitted.
If your password store is owned then the attacker has both your credentials and the second factor. So in that way, the password manager has sacrificed a security fail-safe.
If your password store is owned, you’re fucked. Period. 2FA will offer little failsafe in such a scenario.
Why so? If you don't have second factors in your PW store, then any service which actually implements MFA properly shouldn't let anyone have access to anything.
Re: Ask HN: Why do password managers have TOTP?
#97The team from 1password did a nice writeup, when they introduced storing TOTP in their password manager. Gist is: Most people treat TOTP as a second, time based password (multi step authentication) instead of a second factor. If you truly want 2nd factor, you should never sync your passwords to the phone you are using as 2FA, and never use your passwords on the phone you are using as 2FA. So it depends on your own se…
I've always assumed (possibly incorrectly) that my phone is more secure than my desktop.
Depends on your phone. But it’s also WAY more likely that your phone gets stolen than your desktop does.
Re: Ask HN: Why do password managers have TOTP?
#98Earlier quoted context omitted.
I am not an expert, but "Threat models in which a separate setup would have a benefit include only breaches of your password database itself." doesnt this mean that there is a big difference if the attack vector is by a keylogger? (Which can sniff the Database pw). Are keyloggers not a common thing for threats (I dont know)?
Not sure how common it is but if the endpoint is compromised to the point of having a keylogger installed then it's basically already game over.
Ah, I think I get the point, but is it really like this? The attacker would have to do everything through the endpoint, isnt this cumbersome for the attacker?
Re: Ask HN: Why do password managers have TOTP?
#99Because nobody, not even fancy techies, really cares about security, they care about "good enough" and all the usability they can get.
Re: Ask HN: Why do password managers have TOTP?
#100TOTP = Time-based One Time Password. MFA = Multi Factor Authentication. For those who didn't know, like me. I wish acronyms were less used or at least described when introduced. Like Elon Musk once said: "Don't use acronyms or nonsense words for objects, software or processes at Tesla. In general, anything that requires an explanation inhibits communication. We don't want people to have to memorize a glossary just to…
Ha, I went and researched this too, thinking I'd post the same basic comment. Should have read a little further. In general, I think it's good practice to do like the newspapers and define an abbreviation on first usage (which in this case would be the original post).