TOTPs are also a defense against phishing leading to persistence. You can't phish someone and then lock them out of their account by changing their login details. Other second factors (like ubi-key) are better against phishing because they are cryptographically linked to the domain. This does require some form of challenge-response.
I disagree on phishing protection. In the best case the phisher has 30 seconds to login, and then has enough time to change the login details.
The point is that changing login details often requires the 2FA. And I presume that a TOTP cannot be used twice.
95% of the security of TOTP stuff is that users have no freedom in implementing it and thus cant mess it up. There is no equivalent of having "hunter2" as your password when the user doesn't choose the secret. They cant reuse secrets across sites if they dont choose secrets. Every other realistic threat is not helped by TOTP. There is some threats that in theory TOTP can help with, but dont given how it is used on th…
But then users store these passwords on a sticky note attached to their display device…
Its debatable how bad that is. For most (not all) people, the realistic threats do not have physical access to your computer.
However, this is kind of my point - you might put your password on a sticky not. In TOTP 2FA the equivalent is your qr code. I have never seen anyone print out a qr code and put it on a sticky note beside their computer.
If your password store is owned then the attacker has both your credentials and the second factor. So in that way, the password manager has sacrificed a security fail-safe.
If your password store is owned, you’re fucked. Period. 2FA will offer little failsafe in such a scenario.
> If your password store is owned, you’re fucked. Period.
Factually incorrect. In that scenario, REAL 2FA (the kind not stored in the password store) is the only thing keeping bad guys out until you change passwords.
Side question: why is nobody losing their minds over the fact that almost all other MFA actions rely on your phone, which almost always has access to critical services (banking, work mail, personal mail, possibly ssh, etc). I’m more concerned about losing my Device as many MFA tokens are not backed up in apple ecosystem. The architecture is flawed for conveniences sake.
This is really annoying with employers who assume they can use your personal phone as part of their MFA fig leaf.
Given the preference I’d rather not carry around an additional phone or hw token. But I fully understand those who don’t appreciate it.
You can possibly force bespoke token apps into google Authenticator or the ms variant if they use standard Totp or hotp (ms auth on AAD does not by default but you can force it to provide one during the workflow).
What kind of attack does it make possible that is impossible without TOTP in the password manager? I'm not considering online password managers which IMHO are inherently weaker than local ones. If somebody steals my laptop the passwords database is protected by a master password anyway.
It depends in part on the OS and how easy it is to go from any remote access to full password manager access. On most desktop systems it is very easy the next time the password manager is used, so a true second factor gives you more time to detect a remote breach of your account before getting locked out of all of your accounts. Everything you access between the breach and you discovering it could still be compromised (where compromised can mean the account is gone for good) so it is of limited use in practice but not necessarily useless considering the complexity of software that access the network (of course it can be nearly impossible to detect a breach but often isn't in practice). It would be much more effective at protecting access to accounts if there was a distinct account change TOTP vs. the regular one for login (or, say, one to make small purchases and a different one for larger money transfers), but I've never seen that. If you don't access financial accounts every day it can give you some time to detect the breach if you are lucky.
I personally have a second password database that generates my MFA codes. I only open that on my phone (because I think the KeePass desktop app doesn't support TOTP out of the box). I guess in this case it's like a second password. Only really useful if someone only manages to bruteforce/spy my main master key but not the second one, right? Would love to hear opinions on this, I might be missing something.
KeePass supports TOTP out of the box without any plugins since the 2.47 release in January 2021: https://keepass.info/news/n210109_2.47.html Usage: https://keepass.info/help/base/placeholders.html#otp
TOTP and MFA are 2 different things even though they are often used together.
MFA is all about having a second physically held device to authenticate, TOTP is one of the mechanisms by which this is done.
Not everything needs MFA, however it is often mandated so having the ability to generate TOTP in a situation like this (such as when an account is shared and pure security is not crucial) is convenient.
This is also the case for bitwarden. I think it's only browser built in autofill that does it proactively
Bitwarden has an auto fill option, though it was off by default last I checked. LastPass too has auto fill yet mitigated by requiring a click to populate the match.
> LastPass too has auto fill yet mitigated by requiring a click to populate the match.
Actually, if you login/authenticate to LastPass, it will automatically autofill the forms within all of your open tabs. It's quite irritating--I haven't figured out a way to disable it.