Doesn't this break the purpose of MFA, which is that the thing you know (password) is separate from the thing you have (MFA device)? If so, then why do all of the reputable password managers include TOTP functionality?
Ask HN: Why do password managers have TOTP?
1–10 of 124 posts
Re: Ask HN: Why do password managers have TOTP?
#2I think that you are right, but I don't want 2FA, so I use the TOTP from my password manager.
Also, I think that we should be able to reset a regular password with a TOTP?
Why do we need email?
Re: Ask HN: Why do password managers have TOTP?
#3Because some sites/companies force people who do not want MFA to use MFA, and people aren't willing to sacrifice convenience for security like that.
(Probably also because some people really don't get the point of 2FA and demand that feature, but the above is enough of a legitimate reason to support it.)
Re: Ask HN: Why do password managers have TOTP?
#4A password manager (database) is not something you know. It's something you have.
Re: Ask HN: Why do password managers have TOTP?
#5A password manager (database) is not something you know. It's something you have.
The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these should be different things.
Re: Ask HN: Why do password managers have TOTP?
#6Because a password manager isn't the only way a password can get exposed, and having a secure way to save your TOTP secrets is not a bad idea either in case you lose your hardware key.
Re: Ask HN: Why do password managers have TOTP?
#7What kind of attack does it make possible that is impossible without TOTP in the password manager?
I'm not considering online password managers which IMHO are inherently weaker than local ones.
If somebody steals my laptop the passwords database is protected by a master password anyway.
Re: Ask HN: Why do password managers have TOTP?
#8I think it’s a decent enough balance for most people.
It’s still something you know plus something you have. If your credentials are somehow intercepted, you’re still covered.
Presumably it only falls down in the event your machine is fully compromised at which point you have bigger things to worry about.
With that said, it’s worth having separate 2FA setup on your actual password manager.
Re: Ask HN: Why do password managers have TOTP?
#9The whole thing you know. / thing you have is very outdated thinking. It made sense as a way to explain it 20+ years ago when 2fa was primarily done with physical RSA fobs, but it makes no sense in the modern world of TOTP, password managers, etc.
For one thing, TOTP any it’s nature isn’t tied to a thing I have. Heck - you could build a TOTP token web service accessible from anywhere, it’s just an algorithm.
Secondly, if you’re using a password manager, you likely don’t know the password, so that part doesn’t fit either.
And if you insist on still fitting that square peg into todays round hole: The thing I know is my password managers’ decryption key, and the thing I have is my laptop / iPhone.
Re: Ask HN: Why do password managers have TOTP?
#10Where exactly are people supposed to store their recovery keys? I get that theoretically it’s supposed to be cold storage.
Suppose you’re actually targeted by government, and you want to protect access you only have two possibilities.
Store it in encrypted cold storage that people that are targeting you have access to or forget them altogether and lose access yourself.
I feel like people have forgetting what is actually being protected from.
Most MFA apps on iOS either store the keys in iCloud Keychain or some some third party sync service or not at all when your phone breaks.
I think the threat model isn’t well thought through at all.
An offline encrypted keystore doesn’t in fact have a worse security characteristic than most options listed above.
And yes theoretically an hsm is better but realistically speaking I think a physical key that I carry around every day isn’t almighty either.