Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

121–130 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#121

Post by niij »

01HNNWZ0MV43FF wrote: post #54
WXLCKNO wrote: post #48

Earlier quoted context omitted.

After seeing people lose cryptocurrency first hand through the LastPass leaks (hot wallet seed phrases, which is still stupid to have online but..), I really feel like the odds of a leak being the cause of any issues higher than a bad password, for tech savvy security conscious users at least.

Wasn't that because they had backed up their password vaults to LastPass' cloud service? I use KeePass, never upgrade it, and only back it up to my own cold spinning drives. If malware stole my local vault I'd be in trouble, but it's more convenient than keeping my passwords on paper.

LastPass is inherently a SaaS, right? There is no ability to use it without syncing your vault to their servers.

Re: Why does storing 2FA codes in your password manager make sense?

#122

Post by crazygringo »

jamesmotherway wrote: post #88
crazygringo wrote: post #60

Earlier quoted context omitted.

Good point about it being similar to passkeys. But why would it be better to use passkeys? Because don't sites with passkeys generally still allow you to fall back to password, since it's common for people to lose their phone and then lose their passkey? Whereas sites with 2FA obviously don't, and have more complicated/secure recovery mechanisms? So seems to me like 2FA (TOTP's) are currently vastly better in practic…

Hardware keys and passkeys are better because they can't be phished. In the case of hardware keys, one should register multiple to prevent lockout. Most implementations of passkeys seem to be portable, letting them exist on multiple devices (something that gives me pause). If an adversary can successfully phish someone, they can often also trick them into providing TOTP codes or approving push notifications. However,…

> Hardware keys and passkeys are better because they can't be phished.

I think you're missing the point I made -- that because of the way sites are currently set up, your password can be phished even if you have a passkey, and your password is good enough to get you in.

So given that that is the current state of things, isn't TOTP better because it prevents this? Because at least the TOTP won't let an adversary get in a second time.

Re: Why does storing 2FA codes in your password manager make sense?

#123

Post by yablak »

ziml77 wrote: post #55
jasonjayr wrote: post #45

Earlier quoted context omitted.

The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you. At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.

Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.

I'm also interested in the answer to this question. Can one separate the cracking of the password and the key?

Re: Why does storing 2FA codes in your password manager make sense?

#125

Post by justinclift »

niij wrote: post #121
01HNNWZ0MV43FF wrote: post #54

Earlier quoted context omitted.

Wasn't that because they had backed up their password vaults to LastPass' cloud service? I use KeePass, never upgrade it, and only back it up to my own cold spinning drives. If malware stole my local vault I'd be in trouble, but it's more convenient than keeping my passwords on paper.

LastPass is inherently a SaaS, right? There is no ability to use it without syncing your vault to their servers.

Maybe Bitwarden would be the better alternative, as its OSS?

https://github.com/bitwarden

Re: Why does storing 2FA codes in your password manager make sense?

#126

Post by BenjiWiebe »

pwg wrote: post #46
sneak wrote: post #38

Earlier quoted context omitted.

The most common 2FA mobile app that isn’t a password manager is Google Authenticator. Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Also, TOTP in general is bad, because it is easily phished, just like passwords. Using a password manager to store TOTP cuts down on phishing risk as it won…

FreeOTP+, available on FDroid [1] provides for import/export of one's stored codes. The problem with "phishing" is not the technology. Phishing is 100% a human issue and no matter what tech. you might use, those humans vulnerable to being phished will find a way to be phished. [1] https://f-droid.org/en/packages/org.liberty.android.freeotpp...

What would be the way to phish someone who has a hardware security key that they have to touch?

Re: Why does storing 2FA codes in your password manager make sense?

#127

Post by jamesmotherway »

crazygringo wrote: post #122
jamesmotherway wrote: post #88

Earlier quoted context omitted.

Hardware keys and passkeys are better because they can't be phished. In the case of hardware keys, one should register multiple to prevent lockout. Most implementations of passkeys seem to be portable, letting them exist on multiple devices (something that gives me pause). If an adversary can successfully phish someone, they can often also trick them into providing TOTP codes or approving push notifications. However,…

> Hardware keys and passkeys are better because they can't be phished. I think you're missing the point I made -- that because of the way sites are currently set up, your password can be phished even if you have a passkey , and your password is good enough to get you in. So given that that is the current state of things, isn't TOTP better because it prevents this? Because at least the TOTP won't let an adversary get…

Sorry, I overlooked part of your post earlier - I'm tired. As I previously alluded to, I don't use passkeys due to concerns about their implementation. Whether passkeys are better than TOTP really depends on the individual user's circumstances.

Which service is it? Do they ever use that password?

If I were used to signing in with a passkey, I'd find a password prompt suspicious. While the average person might not, it's also possible they would have forgotten the password entirely. There are other services that force TOTP even with hardware keys enrolled. Technically they can be phished, but it would not be successful in all cases.

Unfortunately, varying behavior and support for multifactor protocols (along with risky reset flows) makes it hard to give blanket recommendations.

Re: Why does storing 2FA codes in your password manager make sense?

#128

Post by EPWN3D »

jasonjayr wrote: post #45
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you. At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.

The threat model of password managers and encryption as a whole assumes that the adversary has the ciphertext. If the adversary can decrypt it, then the encryption algorithm is fundamentally broken.

There is literally no point to encryption if possession of the ciphertext is sufficient to extract the secret.

Re: Why does storing 2FA codes in your password manager make sense?

#129

Post by number6 »

bluGill wrote: post #110
baliex wrote: post #81

Earlier quoted context omitted.

> If you can remember it any modern computer can guess it in a short time. That's not true. A long sentence of your choosing is easy to memorise and plenty long enough to not be able to be guessed by a computer (brute force).

That isn't a word though.

As a German I have access to words like "Moselschifffahrtspolizeimützenverordnung" and that's a mild one :)

Re: Why does storing 2FA codes in your password manager make sense?

#130

Post by throwpoaster »

dahart wrote: post #44
throwpoaster wrote: post #11

I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.

Wild! Would that actually work in the long run? It could cause you a lot of trouble, I’m sure, but it seems like if you have any legal documentation, a lawyer would easily fix it. And it seems like it’s probably illegal to try to remove someone without consent or authorization, so it could potentially backfire pretty hard for him? I know this happens sometimes, and I’m thankful my partnerships have never gone this ba…

The law is amazingly difficult to actually enforce against someone who simply will not comply. If everything goes to a potential finding of contempt it takes ages to win by inches. This is what I ended up doing. Literally took 2+ years.

I “won” in the end — the board fired him and appointed me CEO - but it destroyed the company.

And yes, I saw it coming, but was hoping I could control him until we found revenue and the pressure came off. This was illogical because people like that cannot find revenue.

Post reply on HN