Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

101–110 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#101

Post by WhyNotHugo »

The first reasoning basically summarises to "storing 2FA token in a password manager protects against phishing because the TOTP token won't be autocompleted on the wrong domain".

Any decent password manager would avoid autocompleting the password on the wrong domain in the first place. I.e.: it will already protect against phishing attacks anyway.

1Password's documentation use to have a whole article about how bad an idea it was to store TOTP in a password manager — but their stance completely changed at some point. Around the same time they started _recommending_ that you do so, and presented it as a key feature in the marketing material.

---

Personally, I think that the only valid reason to store a TOTP secret in password manger is when you don't really care too much about an account (e.g.: prefer convenience over security), but the website demands that I set up 2FA.

Re: Why does storing 2FA codes in your password manager make sense?

#102

Post by forty »

mid-kid wrote: post #67

The reason I store 2FA codes in my password manager is as a protest to companies forcing me to have a 2FA. I don't want to be randomly locked out of my google account due to not having a usable 2FA, and I also don't want to depend on having a single device be always available to provide the codes. In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwo…

Yes, my point of view is that using a password manager with unique and strong passwords everywhere is bringing most of the benefits you get with TOTP, and then you can have TOTP for compliance with security policy only.

Re: Why does storing 2FA codes in your password manager make sense?

#103

Post by Modified3019 »

bluGill wrote: post #68
ziml77 wrote: post #55

Earlier quoted context omitted.

Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.

The password is generally the weak point. If you can remember it any modern computer can guess it in a short time. Which is why password generation is so imporant.

Paraphrases are much easier than passwords in this regard. Though I fear keylogging more than brute forcing what my main password is.

But this is why I use security keys like yubikeys. Doesn’t matter if an attacker knows my main password for any number of reasons, there’s fuckall they can do with it without my physical key.

And even if they get into my vault and extract passwords, for many websites (in particular the most important ones) they’d still need to use my security key, they can’t just use the passwords.

Attacks are still possible (with browser session fuckery?) but much harder that yet another breach where a website was storing passwords in plaintext

Note, it’s best to not select “remember me” for Bitwarden: https://bitwarden.com/help/twostep-faqs/#q-why-is-bitwarden-...

Re: Why does storing 2FA codes in your password manager make sense?

#104

Post by WhyNotHugo »

mid-kid wrote: post #67

The reason I store 2FA codes in my password manager is as a protest to companies forcing me to have a 2FA. I don't want to be randomly locked out of my google account due to not having a usable 2FA, and I also don't want to depend on having a single device be always available to provide the codes. In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwo…

FWIW, you can store 2FA/TOTP tokens on more than one device. For example, I store many on two separate Yubikeys.

Then again, I do this for accounts that I really care about, I just keep TOTP in my password manager for accounts that are not worth the effort.

Re: Why does storing 2FA codes in your password manager make sense?

#105

Post by baobabKoodaa »

cycomanic wrote: post #89
baobabKoodaa wrote: post #61

Earlier quoted context omitted.

> Did you read the article? That's what they say. No, that's not what they say. If you read the text that you just now quoted, you will see that it says "storing your 2FA in your password manager is an acceptable solution due to the convenience benefits it provides". Clearly the writer of that text believes there _is_ something wrong with having 2FA completely separate from the password vault: it is less convenient,…

They say it's less convenient, that doesn't mean they say it's wrong. And yes it is less convenient, why are you saying it's "horrible"? Security is always about compromises, if the less convenient method causes people to come up with workarounds then it would be worse even if in theory it's more secure.

> if the less convenient method causes people to come up with workarounds then it would be worse even if in theory it's more secure

but that's literally what this is... the less convenient method (2FA) caused people to come up with workarounds (saving 2FA secrets in their password vaults)... and I'm saying it's horrible

Re: Why does storing 2FA codes in your password manager make sense?

#106

Post by WhyNotHugo »

cycomanic wrote: post #79

It's interesting how many argue that putting 2FA codes into a password manager is wrong because you combine 2 factors into one (not don't fully agree with that reasoning), but then are happy with passkeys. How are passkeys better?

Passkeys are 1 factor authentication.

They are often better than only using a password (merely due to the fact that most humans pick terrible passwords).

But using a password + 2FA generally is safer than passkeys. This is especially true if you use webauthn for 2FA, since now one of your factors is basically the passkey.

Re: Why does storing 2FA codes in your password manager make sense?

#107

Post by baobabKoodaa »

yoble wrote: post #93
baobabKoodaa wrote: post #50

Earlier quoted context omitted.

Same here. It seems like they are very narrowly optimizing for the extremely rare case of a person who simultaneously: A) Is fooled by a phishing attack and B) Is not fooled enough to manually copy-paste credentials from their password manager after noticing that the autofill didn't work Does a person like this exist somewhere? Sure, if you interview 1 million people, I'm sure you will find 1 person like this. It is…

In my previous company we hired a startup that did security training, that recommanded everyone use a password manager. And one of their test was that they sent a fake phishing email to people (randomized over a couple of months so not everyone would get it the same day). I don't remember the exact number but something like 30% of people who didn't use a password manager got caught. Basically no-one using a manager w…

The most important bit of information is missing from your post: was everyone using 2FA? If yes, then you make a relevant point.

Re: Why does storing 2FA codes in your password manager make sense?

#108

Post by swat535 »

ww520 wrote: post #34
throwpoaster wrote: post #11

I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.

While it’s regrettable you had someone you trusted betrayed you, the lesson is more of never share your password manager with others.

Exactly, it’s like people complaining about locks when they hand over their keys to another person and suffer theft.

The lesson here is using granular permissions and sharing things selectively, more importantly never giving master access to anyone.

Re: Why does storing 2FA codes in your password manager make sense?

#109

Post by zzyzxd »

watermelon0 wrote: post #52
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

If you store both in one place, it's similar to 1FA. In such case it's a lot better to just use passkeys (where supported).

How many places is generally irrelevant. If a system requires user to provide 2 factors to authenticate, it is 2FA. A password manager software itself should be no exception.

Re: Why does storing 2FA codes in your password manager make sense?

#110

Post by bluGill »

baliex wrote: post #81
bluGill wrote: post #68

Earlier quoted context omitted.

The password is generally the weak point. If you can remember it any modern computer can guess it in a short time. Which is why password generation is so imporant.

> If you can remember it any modern computer can guess it in a short time. That's not true. A long sentence of your choosing is easy to memorise and plenty long enough to not be able to be guessed by a computer (brute force).

That isn't a word though.
Post reply on HN