What's TOTP?
Ask HN: Why do password managers have TOTP?
101–110 of 124 posts
Re: Ask HN: Why do password managers have TOTP?
#102I really like having totp functionality. I use a yubikey for TOTP and boot into an air gapped machine with keypass to store the TOTP codes in case I lose or break the yubikey. I don’t store TOTP codes in my main password manager, but it’s not completely insane. You’re screwed if someone gets your decrypted password database, but you’re still protected from most other attack vectors.
Re: Ask HN: Why do password managers have TOTP?
#103Earlier quoted context omitted.
I think that auto-suggest, meaning the password manager only suggests a password, but you need to actively click on the suggestion in order for the password to be entered, would satisfy both requirements: mitigate phishing and exfiltration. This is the default for 1password.
The problem is not on the browser interface side but on the interface of the secure password store: here you would need to give your ok (like with a hw key). At least in my password manager it seems possible to impersonate the browser after extracting the shared communication token and then query the whole database once it is unlocked from a random client.
What's the threat model you are considering?
Re: Ask HN: Why do password managers have TOTP?
#104Earlier quoted context omitted.
Actually interestingly point number one probably holds true, since very few GUI password managers actually document their threat model at all and actually evaluate their design decisions accordingly. E.g. typical browser extensions if used with no additional confirmation allow easy local exfiltration of passwords. Particularly if actual user input on each request is needed TOTP would provide additional benefits (simi…
Depending on your perspective, a password manager with autofill could actually be more secure. If password managers autofill or suggest accounts based on matching domain , then you're insulated from phishing attacks due to not validating the domain. If you always copy-paste your credentials, you are relying on your own perfect vigilance in checking the domain when pasting the password for the intended site into the a…
I remember KeePass had a feature where the autofill was supposed to be safe against key loggers (as opposed to typing out the password yourself)
Re: Ask HN: Why do password managers have TOTP?
#105I keep TOTP in my password manager, but my password manager is encrypted with a hardware key, a PIN code, and even getting the encrypted files depends on getting into my private git server. I also only use TOTP on sites that don't support u2f/fido/webauthn or implement it badly (like amazon that only allows a single key).
You can actually use multiple security keys on AWS I found out. It requires you to use the yubico authenticator app though. Essentially your security key stores the MFA secrets on it, and the yubico authenticator app accesses them for TOTP. You can register multiple keys in the authenticator app. So even though you can only have one MFA virtual device in AWS, that one virtual device is backed by multiple keys.
Re: Ask HN: Why do password managers have TOTP?
#106Earlier quoted context omitted.
Not sure how common it is but if the endpoint is compromised to the point of having a keylogger installed then it's basically already game over.
Ah, I think I get the point, but is it really like this? The attacker would have to do everything through the endpoint, isnt this cumbersome for the attacker?
It would be, but if they had a keylogger installed then the endpoint is completely owned, in which case they could just exfiltrate the password database from memory. Or they can just pilfer authentication/session tokens directly once you logged in. More generally, making things more cumbersome (in the sense of requiring more steps) doesn't really provide any meaningful security since it can generally be automated anyway.
Re: Ask HN: Why do password managers have TOTP?
#107Earlier quoted context omitted.
If your password store is owned then the attacker has both your credentials and the second factor. So in that way, the password manager has sacrificed a security fail-safe.
If your password store is owned, you’re fucked. Period. 2FA will offer little failsafe in such a scenario.
Not quite, that's why 2FA is supposed to be a second factor, not just extra data in the same place.
If your second factor is on separate hardware then even total compromise of the first piece of hardware (the laptop containing the password database) is not sufficient.
The separate hardware could be many things. One is something like yubikey etc. Or a separate computer with the TOTP secrets, etc.
Re: Ask HN: Why do password managers have TOTP?
#108Earlier quoted context omitted.
The problem is not on the browser interface side but on the interface of the secure password store: here you would need to give your ok (like with a hw key). At least in my password manager it seems possible to impersonate the browser after extracting the shared communication token and then query the whole database once it is unlocked from a random client.
What's the threat model you are considering?
Well considering that the local password managers make a great fuzz about memory randomisation and protection of localhost communication, I would consider a trojan running under user privileges a threat myself that a password manager should address. Otherwise it seems little better than a plaintext password file saved on an encrypted hard drive. However, my point is that mostly I just want to know what the software is good for, ie. protecting me against.
Re: Ask HN: Why do password managers have TOTP?
#109The team from 1password did a nice writeup, when they introduced storing TOTP in their password manager. Gist is: Most people treat TOTP as a second, time based password (multi step authentication) instead of a second factor. If you truly want 2nd factor, you should never sync your passwords to the phone you are using as 2FA, and never use your passwords on the phone you are using as 2FA. So it depends on your own se…
> and never use your passwords on the phone you are using as 2FA
Notably, this also involves not logging into the same email account that you use for signups - it would allow the attacker to bypass the password manager completely by requesting a password reset.
I guess you could solve this by having one email address for signups and another to communicate with people, but you would still be giving up email notifications (such as “your order has been shipped”) delivered to your phone.
Re: Ask HN: Why do password managers have TOTP?
#110Earlier quoted context omitted.
TOTPs are also a defense against phishing leading to persistence. You can't phish someone and then lock them out of their account by changing their login details. Other second factors (like ubi-key) are better against phishing because they are cryptographically linked to the domain. This does require some form of challenge-response.
I'm not sure this is a meaningful threat model. "Well, the adversary can authenticate as me but they'll have to reauthenticate to change my credentials so I'm a little bit safe" is a major stretch. You've already been pwned at that point and not a lot of services force a 2FA step on actions post-login.
Most services I have used actually did require 2fa on authentication relevant changes post login. That's why I mentioned this slight protection.
I'll grant the threat model is of marginal relevance.