Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

131–140 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#131

Post by throwpoaster »

kubo6472 wrote: post #24
throwpoaster wrote: post #11

I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.

I'm sorry this happened to you, but it highlights another very important factor. Don't keep all keys to the kingdom on one person. Always divide and conquer. Keep power distributed between multiple people. I worked at a company of 500+ people, and I'm sure the CEO didn't have access to all the IT people's stuff. They only cared that everything works and meet their quarterly goals. Shall the IT person feel like sabota…

This, yes, but there’s a really interesting corollary:

If you’re on a small team (~5 people) the person obsessed with access controls cannot be trusted.

Re: Why does storing 2FA codes in your password manager make sense?

#132

Post by throwpoaster »

Eric_WVGG wrote: post #86
throwpoaster wrote: post #11

I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.

That’s harrowing. If any journalists are lurking in this discussion, this would make a decent article.

Reply here with info and I’ll reach out. Have to be careful with NDAs and such.

Re: Why does storing 2FA codes in your password manager make sense?

#133

Post by kcartlidge »

WXLCKNO wrote: post #48
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

After seeing people lose cryptocurrency first hand through the LastPass leaks (hot wallet seed phrases, which is still stupid to have online but..), I really feel like the odds of a leak being the cause of any issues higher than a bad password, for tech savvy security conscious users at least.

> After seeing people lose cryptocurrency first hand through the LastPass leaks

The reason for those losses was partially that LastPass was encrypting with extremely low iterations on long-standing accounts (it also may not have helped that they didn't encrypt URLs either). That was a terrible practice which isn't duplicated by credible alternatives.

As a matter of opinion you may still be right, though personally I consider the risks of a bad password to be higher than a leak purely because without a password manager making it simple to use long random passwords most do tend to be bad ones (duplicated/short/guessable/engineerable) as those are the only ones that are memorable.

It's the usual trade-off between security and usability, with the perfect being the enemy of the good, especially in regard to pushing less technical users to solutions which may not be ideal but are still much safer.

Re: Why does storing 2FA codes in your password manager make sense?

#134

Post by kcartlidge »

gchamonlive wrote: post #63

It's better than not having 2fa, but a breach to your password manager would give any attacker full control over your accounts. A better approach would be to split in two solutions where you store passwords and 2fa keys. I use bitwarden for passwords, but save all 2fa in aegis. These two have different 5 word passphrases prefixed with a regular 8 char password to increase entropy. I save a backup of the 2fa db to a r…

Similar - I use Bitwarden for passwords and Authy for 2FA so a compromise of only one of them is not a disaster (assuming a site supports 2FA which my important ones largely do).

Re: Why does storing 2FA codes in your password manager make sense?

#135

Post by _1tem »

politelemon wrote: post #120
_1tem wrote: post #18

Important to note that not all password managers are equal. Using Apple’s built-in password manager is more secure because it is inherently tied to your biometrics and authentication is hardware-based, i.e Secure Enclave. This is categorically different from web services like Bitwarden or 1Password authenticated by login email and 2FA codes. Even if someone got into your Apple ID they still would be unable to view or…

Absolutely the opposite. Using Apple's built in one is less secure because it is within the ecosystem that you are subject to; if you are locked out of said ecosystem, you are locked out of everything. Password managers should never ever be inside your ecosystem. That is why people often manage the database syncing themselves and relying on the database own strength, eg kdbx.

To insure against being locked out of my Apple ID I simply export and store my own backups periodically. Good idea regardless of which provider you use.

Re: Why does storing 2FA codes in your password manager make sense?

#136

Post by Eddy_Viscosity2 »

ziml77 wrote: post #55
jasonjayr wrote: post #45

Earlier quoted context omitted.

The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you. At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.

Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.

> Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.

Hackers rarely break through the front door. They find a vulnerability elsewhere in the code, your OS, other programs on your computer, the companies servers, the companies staff, and so on. You have to have full faith not just in the encryption algorithm, but its implementation, everything and everyone around it and everywhere it operates and interacts with. Any one of these could be a route in.

Re: Why does storing 2FA codes in your password manager make sense?

#137

Post by _1tem »

pohuing wrote: post #119
_1tem wrote: post #112

Earlier quoted context omitted.

iCloud Passwords is more secure than that. Even a TOTP code and password is not enough to initiate a password sync. You also need to biometrically authenticate a previously synced device

Thinking about it, what happens if you lose your eyes or your fingercups(say for example from frostbite). Are you just screwed or is there a recovery method

I make my own encrypted backups from CSV exports.

Re: Why does storing 2FA codes in your password manager make sense?

#138

Post by bluGill »

number6 wrote: post #129
bluGill wrote: post #110

Earlier quoted context omitted.

That isn't a word though.

As a German I have access to words like "Moselschifffahrtspolizeimützenverordnung" and that's a mild one :)

Stupid German proving me wrong with something that most languages don't have access to.

\s

I'm sure German is not alone, but it is the only one I'm aware of - though with over 7000 known languages I doubt anyone knows enough to state anything with confidence.

Re: Why does storing 2FA codes in your password manager make sense?

#139

Post by gchamonlive »

kcartlidge wrote: post #134
gchamonlive wrote: post #63

It's better than not having 2fa, but a breach to your password manager would give any attacker full control over your accounts. A better approach would be to split in two solutions where you store passwords and 2fa keys. I use bitwarden for passwords, but save all 2fa in aegis. These two have different 5 word passphrases prefixed with a regular 8 char password to increase entropy. I save a backup of the 2fa db to a r…

Similar - I use Bitwarden for passwords and Authy for 2FA so a compromise of only one of them is not a disaster (assuming a site supports 2FA which my important ones largely do).

Authy is nice because it takes care of replication, but once you have all your devices synced I'd disable adding new devices, otherwise it'll expose your 2fa in case of SIM card breaches

Re: Why does storing 2FA codes in your password manager make sense?

#140

Post by skybrian »

cuu508 wrote: post #100
raywu wrote: post #74

Earlier quoted context omitted.

Isn’t this what passkey is trying to sidestep? Assuming the user is at least authenticated on one device.

For people who are bad with computers, I think passkeys could work ok in scenario where somebody has just one device, they never upgrade it, never lose it, never break it, never accidentally click on "log out" in their passkey provider's account.

In other words, having just one device is as bad as having just one key to a safe. You need redundancy to avoid getting locked out.
Post reply on HN