21–30 of 56 posts
While nice for users, this funding model kills anything bigger than a 1 man project in todays world.
Turns out users pay one-time but software developers prefer their salary not to be paid one-time.
Congrats on launching and building something. Unfortunately I think this is very bad for security. We have seen numerous accounts take overs from iMessage and sms based 2fa. This makes it even easier. I also don’t understand why password managers are starting to support storing totp. It is a terrible idea.
Having the totp seed inside a password manager doesn't break this goal, so I'm fine with it.
Of course it means if my password manager gets hacked, there's everything to log in inside, but I'm more concerned about services leaking password hashes that get broken, or accidentally getting phished (and giving up a password + totp combo that can only be used once) instead of my password manager being hacked.
Earlier quoted context omitted.
2FA code (rng seed) can be stored to password managers directly as well. It is access requirement for something else, which fulfills the criteria of 2FA. In this case, there is requirement to access the browser and phone.
But if you have it in the PW manager, isn’t it moot? I guess it’s still safe against leaking of your password only.
It depends on your threat model vs usability/ease of use.
If your 2FA code is as autocompletable as your password, is it really a second factor?
Even if it is stored in your password manager, it is still useful. Consider the case where your network or website is compromised: the password is compromised and can be reused, but the totp 2fa that is in your password manager still prevents login by anyone who obtained your password. There are many attack scenarios but storing 2fa and enabling autocomplete definitely does not make it useless.
I'm glad to see someone making this for Chrome. I really like how Safari does it. It can check mail and messages, then delete the message after verifying. One of the reasons why I am finding it difficult to switch from safari.
I'm glad to see someone making this for Chrome. I really like how Safari does it. It can check mail and messages, then delete the message after verifying. One of the reasons why I am finding it difficult to switch from safari.
Broken websites aren't enough of a reason to switch?
> One-time payment A license for Faktor is one-time purchase that gives you a life-time license. While nice for users, this funding model kills anything bigger than a 1 man project in todays world. Turns out users pay one-time but software developers prefer their salary not to be paid one-time.
If your 2FA code is as autocompletable as your password, is it really a second factor?