21–30 of 124 posts
A password manager (database) is not something you know. It's something you have.
The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these should be different things.
Earlier quoted context omitted.
The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these should be different things.
If someone get access to my password manager, I’m screwed anyway. It contains far enough information to bypass any MFA of any service.
The way I understand it, the password database should only contain the passwords; then if someone got access to it (or your email app, same thing, as they would just do a password reset) 2FA would still protect you.
A password manager (database) is not something you know. It's something you have.
The assumption is that your password manager is only accessible on physical devices that you have authorized. The stored data is encrypted and will only decrypt upon being authenticated by whatever means you have setup (i.e. password, fingerprint, face id, etc.). The only way for a potential attacker to utilize an OTP generated by your password manager would be to somehow gain control of the physical devices where th…
The biggest vector MFA protects against isn't really brute forcing (though it helps there); its password phishing. This is literally the only reason behind why Google's "account compromises dropped to zero after we required MFA internally" thing is a thing. Its easy to phish a password; but phishing MFA codes is a lot harder because, primarily, they're temporal. Phishing one is possible, but it would require the attacker to immediately use the code they phished, which significantly protects against broad phishing campaigns (as, automating a password phish + an MFA phish + logging in with that info within 30 seconds + navigating to the change password and remove MFA screen + phishing for a second and third MFA code to change the password and remove MFA is near-impossible). Spear-phishing can still be a threat vector, but its much rarer and also made more difficult.
The assumption is that your password manager is only accessible on physical devices that you have authorized. The stored data is encrypted and will only decrypt upon being authenticated by whatever means you have setup (i.e. password, fingerprint, face id, etc.). The only way for a potential attacker to utilize an OTP generated by your password manager would be to somehow gain control of the physical devices where th…
Right; if an attack gains access to your password vault, then one vector MFA can protect against (the multi-factor part) isn't valid. But that's not the only vector. The biggest vector MFA protects against isn't really brute forcing (though it helps there); its password phishing. This is literally the only reason behind why Google's "account compromises dropped to zero after we required MFA internally" thing is a thi…
I think it’s a decent enough balance for most people. It’s still something you know plus something you have. If your credentials are somehow intercepted, you’re still covered. Presumably it only falls down in the event your machine is fully compromised at which point you have bigger things to worry about. With that said, it’s worth having separate 2FA setup on your actual password manager.
Do you mean things like seeing your photos?
If your 2FA is not stored on the same machine then the attacker won’t be able to log into your bank / brokerage account, and that’s something I consider the main thing to worry about.
A password manager (database) is not something you know. It's something you have.
The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these should be different things.
Gist is: Most people treat TOTP as a second, time based password (multi step authentication) instead of a second factor. If you truly want 2nd factor, you should never sync your passwords to the phone you are using as 2FA, and never use your passwords on the phone you are using as 2FA.
So it depends on your own security concerns if you want to treat TOTP as a true second factor or as a secondary, time based password only.
Long answer: In practice, TOTP schemes are used (from a webadmin point of view) just to stop credential stuffing attacks [1].
There is very little additional security in generating TOTPs on a dedicated device, such as a smartphone, compared to generating them on the password manager itself. Threat models in which a separate setup would have a benefit include only breaches of your password database itself.
For savvy users with unique passwords, protecting against that threat model offers little benefit at a significant convenience penalty, as such attacks are unlikely to begin with. If MFA with hardware tokens is not an option, then it might not be worth the hassle of TOTPs.
As such, password managers that offer TOTP are useful in scenarios where using TOTP is mandatory and does not provide security benefits.