Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

111–120 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#111

Post by _1tem »

watermelon0 wrote: post #35
_1tem wrote: post #18

Important to note that not all password managers are equal. Using Apple’s built-in password manager is more secure because it is inherently tied to your biometrics and authentication is hardware-based, i.e Secure Enclave. This is categorically different from web services like Bitwarden or 1Password authenticated by login email and 2FA codes. Even if someone got into your Apple ID they still would be unable to view or…

iCloud syncs passwords between your devices. If someone can login via your Apple ID, which means that the person knows username/password, and can also convince you to provide them with 2FA code that gets shown on your existing device, they can just add a new device to your account, and get passwords to sync to it.

Nope. Check the Apple documentation, that’s not how it works. Even if Mallory gets your Apple ID and 2FA code you still need biometrics from a nearby device to initiate password sync.

This is a special requirement for Passwords that does not apply to other encrypted data in your Apple account.

Re: Why does storing 2FA codes in your password manager make sense?

#112

Post by _1tem »

alehlopeh wrote: post #47
watermelon0 wrote: post #35

Earlier quoted context omitted.

iCloud syncs passwords between your devices. If someone can login via your Apple ID, which means that the person knows username/password, and can also convince you to provide them with 2FA code that gets shown on your existing device, they can just add a new device to your account, and get passwords to sync to it.

If someone knows your username and password and can convince you to give them a TOTP code, then yeah they can log in to your account. That’s hardly iCloud-specific.

iCloud Passwords is more secure than that. Even a TOTP code and password is not enough to initiate a password sync. You also need to biometrically authenticate a previously synced device

Re: Why does storing 2FA codes in your password manager make sense?

#113

Post by Brian_K_White »

Modified3019 wrote: post #103
bluGill wrote: post #68

Earlier quoted context omitted.

The password is generally the weak point. If you can remember it any modern computer can guess it in a short time. Which is why password generation is so imporant.

Paraphrases are much easier than passwords in this regard. Though I fear keylogging more than brute forcing what my main password is. But this is why I use security keys like yubikeys. Doesn’t matter if an attacker knows my main password for any number of reasons, there’s fuckall they can do with it without my physical key. And even if they get into my vault and extract passwords, for many websites (in particular the…

This leaves yourself too vulnerable for my taste.

I like, no I think it's simply a hard requirement, that I can recover from nothing but the contents of my head. I can wake up naked in a foreign country and regain everything.

Re: Why does storing 2FA codes in your password manager make sense?

#114

Post by _1tem »

anonyme-honteux wrote: post #40
_1tem wrote: post #18

Important to note that not all password managers are equal. Using Apple’s built-in password manager is more secure because it is inherently tied to your biometrics and authentication is hardware-based, i.e Secure Enclave. This is categorically different from web services like Bitwarden or 1Password authenticated by login email and 2FA codes. Even if someone got into your Apple ID they still would be unable to view or…

It's not a good thing at all that what manages the secrets of my digital life is hardware based... on the hardware of one single vendor

You have to trust your device manufacturer anyway.

Re: Why does storing 2FA codes in your password manager make sense?

#115

Post by jerf »

dns_snek wrote: post #98
jerf wrote: post #28

Earlier quoted context omitted.

Putting your 2FA into your password manager doesn't "reduce" it to "something you know". It proves it was "something you know" all along. If it can be put into a password manager, it's "something you know", regardless of what the intention is or was. Intentions don't drive what things actually are. On a related notes, "passkeys" are also "something you know" for the same reason. However, that does not mean that TOTP…

> If it can be put into a password manager, it's "something you know", regardless of what the intention is or was. Intentions don't drive what things actually are. That's not a useful distinction and needlessly breaks an otherwise useful model. By that logic, every authentication method is just "something you know" since every piece of information can be represented as a stream of bits, and password managers are well…

I agree with your last sentence and I am finding the know/are/have model actually quite useless in practice, for that very reason. It's all really just variants on knowing, and rather than breaking the world into three categories, two of which don't really exist, it's much more sensible to look at what the differences between the classes of "knowing" is.

For example, while I "know" my TOTP codes, it is relevant that they can not be memorized. While I "know" my passkeys, the differences in how that knowledge is interrogated is relevant. What isn't useful is modeling either of those things as "have" versus "know", because by putting them in my password manager, I have objectively broken them as a concept of "thing I have".

But people marry their models, so it'll be a while for this to get through our collective skulls. It looked so useful at first.

Re: Why does storing 2FA codes in your password manager make sense?

#116

Post by Dylan16807 »

eblume wrote: post #33
taviso wrote: post #26

I'm not familiar with the expert they consulted, but the claim that "The main advantage of 2FA is that it is much more difficult to gain access to your accounts via phishing attacks" is just plain false. TOTP or SMS-2FA are obviously phishable, if you just entered your password into a phishing site, why wouldn't you also enter a TOTP code? I usually point to Modlishka as a practical example ( https://vimeo.com/308709…

The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password. Your point that if you've already decided to enter your password then entering the 2FA code isn't much of a hurdle is sound, but from the perspective of a user of 1Password, it is indeed very surprising (and rare!) when I try to log in to a page and find that 1Password won't show my lo…

> The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password.

Yes, same with the password.

So it is not an advantage of 2FA.

Re: Why does storing 2FA codes in your password manager make sense?

#117

Post by Dylan16807 »

baobabKoodaa wrote: post #107
yoble wrote: post #93

Earlier quoted context omitted.

In my previous company we hired a startup that did security training, that recommanded everyone use a password manager. And one of their test was that they sent a fake phishing email to people (randomized over a couple of months so not everyone would get it the same day). I don't remember the exact number but something like 30% of people who didn't use a password manager got caught. Basically no-one using a manager w…

The most important bit of information is missing from your post: was everyone using 2FA? If yes, then you make a relevant point.

Even if no 2FA was involved at all, it's a good answer to the scenario you were posing.

I think plenty of people will have second thoughts when the password doesn't go.

Re: Why does storing 2FA codes in your password manager make sense?

#118

Post by rkagerer »

connicpu wrote: post #58
WXLCKNO wrote: post #48

Earlier quoted context omitted.

After seeing people lose cryptocurrency first hand through the LastPass leaks (hot wallet seed phrases, which is still stupid to have online but..), I really feel like the odds of a leak being the cause of any issues higher than a bad password, for tech savvy security conscious users at least.

Part of why I avoid password managers that use their own cloud system. Storing my vault in a regular cloud database, not a password-specific one, to me makes it much less likely my vault will be compromised.

Not criticizing, but I'd rather not have it in the Cloud at all.

Re: Why does storing 2FA codes in your password manager make sense?

#119

Post by pohuing »

_1tem wrote: post #112
alehlopeh wrote: post #47

Earlier quoted context omitted.

If someone knows your username and password and can convince you to give them a TOTP code, then yeah they can log in to your account. That’s hardly iCloud-specific.

iCloud Passwords is more secure than that. Even a TOTP code and password is not enough to initiate a password sync. You also need to biometrically authenticate a previously synced device

Thinking about it, what happens if you lose your eyes or your fingercups(say for example from frostbite). Are you just screwed or is there a recovery method

Re: Why does storing 2FA codes in your password manager make sense?

#120

Post by politelemon »

_1tem wrote: post #18

Important to note that not all password managers are equal. Using Apple’s built-in password manager is more secure because it is inherently tied to your biometrics and authentication is hardware-based, i.e Secure Enclave. This is categorically different from web services like Bitwarden or 1Password authenticated by login email and 2FA codes. Even if someone got into your Apple ID they still would be unable to view or…

Absolutely the opposite. Using Apple's built in one is less secure because it is within the ecosystem that you are subject to; if you are locked out of said ecosystem, you are locked out of everything. Password managers should never ever be inside your ecosystem. That is why people often manage the database syncing themselves and relying on the database own strength, eg kdbx.
Post reply on HN