61–70 of 124 posts
I keep TOTP in my password manager, but my password manager is encrypted with a hardware key, a PIN code, and even getting the encrypted files depends on getting into my private git server. I also only use TOTP on sites that don't support u2f/fido/webauthn or implement it badly (like amazon that only allows a single key).
Short answer: Password managers offer this funcionality because there is a demand for it. Long answer: In practice, TOTP schemes are used (from a webadmin point of view) just to stop credential stuffing attacks [1]. There is very little additional security in generating TOTPs on a dedicated device, such as a smartphone, compared to generating them on the password manager itself. Threat models in which a separate setu…
Actually interestingly point number one probably holds true, since very few GUI password managers actually document their threat model at all and actually evaluate their design decisions accordingly. E.g. typical browser extensions if used with no additional confirmation allow easy local exfiltration of passwords. Particularly if actual user input on each request is needed TOTP would provide additional benefits (simi…
If password managers autofill or suggest accounts based on matching domain, then you're insulated from phishing attacks due to not validating the domain. If you always copy-paste your credentials, you are relying on your own perfect vigilance in checking the domain when pasting the password for the intended site into the actual site. By using autofill or autosuggest, the computer is checking the domain for you and the failure to autofill or find related credentials can indicate a phishing attempt by disrupting your expectations.
https://1password.community/discussion/101714/why-is-it-a-go...
Side question: why is nobody losing their minds over the fact that almost all other MFA actions rely on your phone, which almost always has access to critical services (banking, work mail, personal mail, possibly ssh, etc). I’m more concerned about losing my Device as many MFA tokens are not backed up in apple ecosystem. The architecture is flawed for conveniences sake.
I personally have a second password database that generates my MFA codes. I only open that on my phone (because I think the KeePass desktop app doesn't support TOTP out of the box). I guess in this case it's like a second password. Only really useful if someone only manages to bruteforce/spy my main master key but not the second one, right? Would love to hear opinions on this, I might be missing something.
Short answer: Password managers offer this funcionality because there is a demand for it. Long answer: In practice, TOTP schemes are used (from a webadmin point of view) just to stop credential stuffing attacks [1]. There is very little additional security in generating TOTPs on a dedicated device, such as a smartphone, compared to generating them on the password manager itself. Threat models in which a separate setu…
Other second factors (like ubi-key) are better against phishing because they are cryptographically linked to the domain. This does require some form of challenge-response.
Short answer: Password managers offer this funcionality because there is a demand for it. Long answer: In practice, TOTP schemes are used (from a webadmin point of view) just to stop credential stuffing attacks [1]. There is very little additional security in generating TOTPs on a dedicated device, such as a smartphone, compared to generating them on the password manager itself. Threat models in which a separate setu…
TOTPs are also a defense against phishing leading to persistence. You can't phish someone and then lock them out of their account by changing their login details. Other second factors (like ubi-key) are better against phishing because they are cryptographically linked to the domain. This does require some form of challenge-response.
I keep TOTP in my password manager, but my password manager is encrypted with a hardware key, a PIN code, and even getting the encrypted files depends on getting into my private git server. I also only use TOTP on sites that don't support u2f/fido/webauthn or implement it badly (like amazon that only allows a single key).
What happens if you lose the hardware key? Is there a recovery mechanism?
Realistically though, once an attacker's gained access to your computer or phone, there's very little you can do to prevent them misusing that data. You can keep your TOTP on a second device encrypted with a Yubikey that you keep in a vault in Geneva, but it's not overly useful when an attacker can simply call your bank and read out the security reset SMS they sent you/him.
I'm happy to hear from security power users if there's anything I'm missing.