We use it on shared accounts (sometimes they are inevitable)
Before this feature, we had to rely on backup codes.
Ask HN: Why do password managers have TOTP?
81–90 of 124 posts
Re: Ask HN: Why do password managers have TOTP?
#82Earlier quoted context omitted.
Depending on your perspective, a password manager with autofill could actually be more secure. If password managers autofill or suggest accounts based on matching domain , then you're insulated from phishing attacks due to not validating the domain. If you always copy-paste your credentials, you are relying on your own perfect vigilance in checking the domain when pasting the password for the intended site into the a…
I think that auto-suggest, meaning the password manager only suggests a password, but you need to actively click on the suggestion in order for the password to be entered, would satisfy both requirements: mitigate phishing and exfiltration. This is the default for 1password.
This is also the case for bitwarden. I think it's only browser built in autofill that does it proactively
Re: Ask HN: Why do password managers have TOTP?
#83Earlier quoted context omitted.
I've always assumed (possibly incorrectly) that my phone is more secure than my desktop.
Personally I feel it’s a bit weird when people keep their TOTP on the phone they use to access the service that requires the token. If the idea was to keep things seperate, then either your phone shouldn’t when the tokens, or it shouldn’t be used to access secure services. Hardware token still feel like the safest option, but I also don’t what 8 different token generator in my pocket.
A hardware security key would allow you to have one thing in your pocket, used for many sites.
Re: Ask HN: Why do password managers have TOTP?
#84TOTP = Time-based One Time Password.
MFA = Multi Factor Authentication.
For those who didn't know, like me. I wish acronyms were less used or at least described when introduced. Like Elon Musk once said:
"Don't use acronyms or nonsense words for objects, software or processes at Tesla. In general, anything that requires an explanation inhibits communication. We don't want people to have to memorize a glossary just to function at Tesla."
Re: Ask HN: Why do password managers have TOTP?
#85Short answer: Password managers offer this funcionality because there is a demand for it. Long answer: In practice, TOTP schemes are used (from a webadmin point of view) just to stop credential stuffing attacks [1]. There is very little additional security in generating TOTPs on a dedicated device, such as a smartphone, compared to generating them on the password manager itself. Threat models in which a separate setu…
TOTPs are also a defense against phishing leading to persistence. You can't phish someone and then lock them out of their account by changing their login details. Other second factors (like ubi-key) are better against phishing because they are cryptographically linked to the domain. This does require some form of challenge-response.
I'm not sure this is a meaningful threat model. "Well, the adversary can authenticate as me but they'll have to reauthenticate to change my credentials so I'm a little bit safe" is a major stretch. You've already been pwned at that point and not a lot of services force a 2FA step on actions post-login.
Re: Ask HN: Why do password managers have TOTP?
#86The assumption is that your password manager is only accessible on physical devices that you have authorized. The stored data is encrypted and will only decrypt upon being authenticated by whatever means you have setup (i.e. password, fingerprint, face id, etc.). The only way for a potential attacker to utilize an OTP generated by your password manager would be to somehow gain control of the physical devices where th…
Right; if an attack gains access to your password vault, then one vector MFA can protect against (the multi-factor part) isn't valid. But that's not the only vector. The biggest vector MFA protects against isn't really brute forcing (though it helps there); its password phishing. This is literally the only reason behind why Google's "account compromises dropped to zero after we required MFA internally" thing is a thi…
TOTP does not protect against phishing. Automating a phishing of a TOTP is not only not "near-impossible", there are SDKs sold on the black market that do exactly this for a modest fee.
Re: Ask HN: Why do password managers have TOTP?
#8795% of the security of TOTP stuff is that users have no freedom in implementing it and thus cant mess it up. There is no equivalent of having "hunter2" as your password when the user doesn't choose the secret. They cant reuse secrets across sites if they dont choose secrets. Every other realistic threat is not helped by TOTP. There is some threats that in theory TOTP can help with, but dont given how it is used on th…
But then users store these passwords on a sticky note attached to their display device…
Which is pretty good against some real threats. Evil maids are very rare in comparison to credential stuffing.
Re: Ask HN: Why do password managers have TOTP?
#88Where exactly are people supposed to store their recovery keys? I get that theoretically it’s supposed to be cold storage. Suppose you’re actually targeted by government, and you want to protect access you only have two possibilities. Store it in encrypted cold storage that people that are targeting you have access to or forget them altogether and lose access yourself. I feel like people have forgetting what is actua…
If you are actually targeted by the government they'll pwn you with zero days on your browser or whatever. No authentication scheme will save you at that point.
Real users should protect against credential stuffing and, if they can manage it, phishing.
Re: Ask HN: Why do password managers have TOTP?
#89Earlier quoted context omitted.
Depending on your perspective, a password manager with autofill could actually be more secure. If password managers autofill or suggest accounts based on matching domain , then you're insulated from phishing attacks due to not validating the domain. If you always copy-paste your credentials, you are relying on your own perfect vigilance in checking the domain when pasting the password for the intended site into the a…
I think that auto-suggest, meaning the password manager only suggests a password, but you need to actively click on the suggestion in order for the password to be entered, would satisfy both requirements: mitigate phishing and exfiltration. This is the default for 1password.
The problem is not on the browser interface side but on the interface of the secure password store: here you would need to give your ok (like with a hw key). At least in my password manager it seems possible to impersonate the browser after extracting the shared communication token and then query the whole database once it is unlocked from a random client.
Re: Ask HN: Why do password managers have TOTP?
#90For me I weighed the risks and decided that losing my phone and getting locked out of services with 2FA was a more realistic problem than someone compromising my password manager.
I still use 2FA when it's available because it still protects against an individual password leak.