Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why do password managers have TOTP?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 124 posts

Re: Ask HN: Why do password managers have TOTP?

#31

Post by Joeri »

rjzzleep wrote: post #10

Where exactly are people supposed to store their recovery keys? I get that theoretically it’s supposed to be cold storage. Suppose you’re actually targeted by government, and you want to protect access you only have two possibilities. Store it in encrypted cold storage that people that are targeting you have access to or forget them altogether and lose access yourself. I feel like people have forgetting what is actua…

I think being targeted by government or a similar class of advanced threat is not something you should really think about when choosing how you manage passwords, as they will have many ways to target you that don’t involve password compromise at all. Password managers and MFA are about protecting from account compromise by run of the mill cybercriminals. Storing recovery keys on a piece of paper in a safe place is perfectly fine for that class of threats.

Re: Ask HN: Why do password managers have TOTP?

#32

Post by k8sToGo »

If you are really strict about 2Fa, then in theory you would never be able to use your phone that you use for TOTP generation to login to Websites that use this TOTP Code either.

So I'm pretty sure I already broke this separation due to convenience. So might as well put it in my PW Manager.

Re: Ask HN: Why do password managers have TOTP?

#33

Post by petepete »

bigDinosaur wrote: post #19

It's slightly less secure, in the sense that if someone gains access to your password database they'll have access to your MFA codes as well. The only scenario this would really matter in is if something like your phone or laptop was stolen, but not both, and they already could unlock your database file. Practically I'd say that using the TOTP functionality of your password manager is such a big win for the average u…

If you lock your password manager with a hardware security key, you get the best of both worlds. The NFC Yubikey works well in this niche.

Re: Ask HN: Why do password managers have TOTP?

#35

Post by adgjlsfhk1 »

arubania2 wrote: post #26
nerdawson wrote: post #8

I think it’s a decent enough balance for most people. It’s still something you know plus something you have. If your credentials are somehow intercepted, you’re still covered. Presumably it only falls down in the event your machine is fully compromised at which point you have bigger things to worry about. With that said, it’s worth having separate 2FA setup on your actual password manager.

> bigger things to worry about Do you mean things like seeing your photos? If your 2FA is not stored on the same machine then the attacker won’t be able to log into your bank / brokerage account, and that’s something I consider the main thing to worry about.

if a hacker is in your system enough to get totp keys, they can also just pay themselves from your bank account after you log in.

Re: Ask HN: Why do password managers have TOTP?

#36

Post by nerdawson »

arubania2 wrote: post #26
nerdawson wrote: post #8

I think it’s a decent enough balance for most people. It’s still something you know plus something you have. If your credentials are somehow intercepted, you’re still covered. Presumably it only falls down in the event your machine is fully compromised at which point you have bigger things to worry about. With that said, it’s worth having separate 2FA setup on your actual password manager.

> bigger things to worry about Do you mean things like seeing your photos? If your 2FA is not stored on the same machine then the attacker won’t be able to log into your bank / brokerage account, and that’s something I consider the main thing to worry about.

Important documents, source code, emails, ssh keys, you name it.

If your machine is compromised, it’s game over. What’s to stop an attacker intercepting your 2FA codes by swapping out login pages for services you use?

TOTP via PW manager is safer for most people than SMS based 2FA. Having your login codes on a separate device is better still but it’s a trade off with convenience. For some people that won’t be worthwhile but then it’s a question of threat model.

Re: Ask HN: Why do password managers have TOTP?

#37

Post by vladvasiliu »

andrecarini wrote: post #30

Short answer: Password managers offer this funcionality because there is a demand for it. Long answer: In practice, TOTP schemes are used (from a webadmin point of view) just to stop credential stuffing attacks [1]. There is very little additional security in generating TOTPs on a dedicated device, such as a smartphone, compared to generating them on the password manager itself. Threat models in which a separate setu…

There's also the fact that it helps to somewhat mitigate phishing, in that they'll only offer to autofill the code if the website domain matches the one on file, like they do for the password.

Re: Ask HN: Why do password managers have TOTP?

#38

Post by tonyedgecombe »

klaustopher wrote: post #29

The team from 1password did a nice writeup, when they introduced storing TOTP in their password manager. Gist is: Most people treat TOTP as a second, time based password (multi step authentication) instead of a second factor. If you truly want 2nd factor, you should never sync your passwords to the phone you are using as 2FA, and never use your passwords on the phone you are using as 2FA. So it depends on your own se…

I've always assumed (possibly incorrectly) that my phone is more secure than my desktop.

Re: Ask HN: Why do password managers have TOTP?

#39

Post by arubania2 »

nerdawson wrote: post #36
arubania2 wrote: post #26

Earlier quoted context omitted.

> bigger things to worry about Do you mean things like seeing your photos? If your 2FA is not stored on the same machine then the attacker won’t be able to log into your bank / brokerage account, and that’s something I consider the main thing to worry about.

Important documents, source code, emails, ssh keys, you name it. If your machine is compromised, it’s game over. What’s to stop an attacker intercepting your 2FA codes by swapping out login pages for services you use? TOTP via PW manager is safer for most people than SMS based 2FA. Having your login codes on a separate device is better still but it’s a trade off with convenience. For some people that won’t be worthwh…

> swapping out login pages

Hmm you’re right, I didn’t think of the scenario when they would give you the machine back in a tampered state.

I was gonna reply “well just wipe it once you get it back” but that assumes that I know it happened, so I’m still susceptible to the evil maid attack and such.

Also fully agreed with the last paragraph.

Re: Ask HN: Why do password managers have TOTP?

#40

Post by cranekam »

kitbrennan wrote: post #18

I agree, it makes no sense to have them stored in the same password manager. One of the things I like about 1Password is that we were able to switch off the built in TOTP for our whole organisation, and force all TOTP codes to go via Duo Security. Thereby forcing a separate 2FA app.

But both apps are on the same user devices, presumably? If so I can see that splitting them protects against the 1password DB being compromised but not against someone getting access to a user’s phone (which seems more likely to me).
Post reply on HN