Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why do password managers have TOTP?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 124 posts

Re: Ask HN: Why do password managers have TOTP?

#51

Post by mrweasel »

tonyedgecombe wrote: post #38
klaustopher wrote: post #29

The team from 1password did a nice writeup, when they introduced storing TOTP in their password manager. Gist is: Most people treat TOTP as a second, time based password (multi step authentication) instead of a second factor. If you truly want 2nd factor, you should never sync your passwords to the phone you are using as 2FA, and never use your passwords on the phone you are using as 2FA. So it depends on your own se…

I've always assumed (possibly incorrectly) that my phone is more secure than my desktop.

Personally I feel it’s a bit weird when people keep their TOTP on the phone they use to access the service that requires the token. If the idea was to keep things seperate, then either your phone shouldn’t when the tokens, or it shouldn’t be used to access secure services.

Hardware token still feel like the safest option, but I also don’t what 8 different token generator in my pocket.

Re: Ask HN: Why do password managers have TOTP?

#52

Post by rand49an »

I work for an MSP who uses the MFA function of a password manager to access customer accounts, this means 2FA codes can be shared across teams of people and offers significant protection against credentials being stolen as they can't be used once access is revoked to the password manager. We turn off exporting the MFA codes so that also can't be stolen.

Re: Ask HN: Why do password managers have TOTP?

#53

Post by austhrow743 »

Different people have different goals. Just because a buyer for an organisation or a provider of a service wants users to use TFA doesn’t mean the users want to deal with it.

This is sort of like asking why do defence attorneys defend their client of the prosecution wants to convict them or why stores have security cameras if I want to take their stuff for free.

Re: Ask HN: Why do password managers have TOTP?

#54

Post by hsbauauvhabzb »

Side question: why is nobody losing their minds over the fact that almost all other MFA actions rely on your phone, which almost always has access to critical services (banking, work mail, personal mail, possibly ssh, etc).

I’m more concerned about losing my Device as many MFA tokens are not backed up in apple ecosystem.

The architecture is flawed for conveniences sake.

Re: Ask HN: Why do password managers have TOTP?

#55

Post by Aulig »

I personally have a second password database that generates my MFA codes. I only open that on my phone (because I think the KeePass desktop app doesn't support TOTP out of the box).

I guess in this case it's like a second password. Only really useful if someone only manages to bruteforce/spy my main master key but not the second one, right?

Would love to hear opinions on this, I might be missing something.

Re: Ask HN: Why do password managers have TOTP?

#56

Post by mike_d »

happyopossum wrote: post #9

The whole thing you know. / thing you have is very outdated thinking. It made sense as a way to explain it 20+ years ago when 2fa was primarily done with physical RSA fobs, but it makes no sense in the modern world of TOTP, password managers, etc. For one thing, TOTP any it’s nature isn’t tied to a thing I have. Heck - you could build a TOTP token web service accessible from anywhere, it’s just an algorithm. Secondly…

The "modern world of TOTP" wasn't some advancement in thinking. It was cost.

Doing 2FA correctly in isolated hardware is expensive. We traded adoption for an imperfect implementation.

Re: Ask HN: Why do password managers have TOTP?

#57

Post by k8sToGo »

Aulig wrote: post #55

I personally have a second password database that generates my MFA codes. I only open that on my phone (because I think the KeePass desktop app doesn't support TOTP out of the box). I guess in this case it's like a second password. Only really useful if someone only manages to bruteforce/spy my main master key but not the second one, right? Would love to hear opinions on this, I might be missing something.

KeepassXC supports TOTP

Re: Ask HN: Why do password managers have TOTP?

#58

Post by SahAssar »

I keep TOTP in my password manager, but my password manager is encrypted with a hardware key, a PIN code, and even getting the encrypted files depends on getting into my private git server.

I also only use TOTP on sites that don't support u2f/fido/webauthn or implement it badly (like amazon that only allows a single key).

Re: Ask HN: Why do password managers have TOTP?

#59

Post by ttty »

k8sToGo wrote: post #32

If you are really strict about 2Fa, then in theory you would never be able to use your phone that you use for TOTP generation to login to Websites that use this TOTP Code either. So I'm pretty sure I already broke this separation due to convenience. So might as well put it in my PW Manager.

IPhone/android is much More secure than a browser extension or windows, even macos.

Attack surface is much larger.

Re: Ask HN: Why do password managers have TOTP?

#60

Post by k8sToGo »

hsbauauvhabzb wrote: post #54

Side question: why is nobody losing their minds over the fact that almost all other MFA actions rely on your phone, which almost always has access to critical services (banking, work mail, personal mail, possibly ssh, etc). I’m more concerned about losing my Device as many MFA tokens are not backed up in apple ecosystem. The architecture is flawed for conveniences sake.

Use something like Authy. It supports Backup.

Anyways, you are supposed to stash your recovery codes somewhere (not on the phone).

Post reply on HN