21–30 of 147 posts
If someone has my password and my device how will a separate app help me in this case?
Honest question as the 1password model seems to be “something you know and something you have”.
I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and , significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quit…
You speak as if 2FA were something that most people use willingly and not just something they put up with because they're forced to.
People take the path of least resistance; we know this. It's why, for the longest time, people used one password for everything. People don't like using password managers, either, but we would all agree that it's unacceptably insecure to not use them, because the alternative is "one password used everywhere, maybe with a single varying digit on the end".
Backing up TOTP seeds encrypted is a good idea if you know what you’re doing.
It is a security-improving move when humans are factored in, not a trade-off between security and convenience.
I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.
I know this doesn't necessarily apply to smaller companies and startups, but have lawyers write you strong contracts that aren't one-sided, but are full of protections for both sides, if they aren't sabotaging stuff.
Earlier quoted context omitted.
You speak as if 2FA were something that most people use willingly and not just something they put up with because they're forced to.
Which is precisely why it's irresponsible to give people the rope to hang themselves with by supporting 2FA seeds in password managers (much less telling them it's a good idea), IMO. People take the path of least resistance; we know this. It's why, for the longest time, people used one password for everything. People don't like using password managers, either, but we would all agree that it's unacceptably insecure to…
If you remove the ability to store 2FA codes in password managers, the path of least resistance becomes "people don't use 2FA at all".
TOTP or SMS-2FA are obviously phishable, if you just entered your password into a phishing site, why wouldn't you also enter a TOTP code? I usually point to Modlishka as a practical example (https://vimeo.com/308709275) to help visualize this.
In fact, the main (claimed) advantage of 2FA is that it prevents "Credential Stuffing" of reused passwords. I personally don't think TOTP (or similar) are a good solution to this problem at all, but this is a thorny issue.
I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and , significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quit…
Yes, if you use a bad password manager that is fundamentally flawed (like LastPass) then all bets are off but that's not an argument against the principle of storing 2fa codes alongside passwords in a password manager.
I doubt there's a single Bitwarden user on earth who has ever suffered a security incident because they store their 2fa codes in Bitwarden, that's how inconsequential this risk is.
I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and , significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quit…
On a related notes, "passkeys" are also "something you know" for the same reason.
However, that does not mean that TOTP codes are useless. Not all "something you know"s are created equal. However, I shamelessly put my TOTP codes into my password manager. Just because some people mistakenly identified it as "something you have" doesn't mean I need to pretend they are correct. It just inconveniences me for no security gain.
Because there's a trade-off between security and convenience.
Exactly, and is there material difference between OTP in a password manager and a passkey in the password manager?
1. While a password manager should associate a TOTP seed with a domain and only fill codes on that domain, the codes are still visible to you. A convincing phishing attack might trick you into manually entering a code into a fake page. Passkeys don't allow this.
2. TOTP codes are derived from a seed shared between the client and server, so an attacker who gets read access to the server's database could generate your codes. With passkeys, the server can only validate a signature, not generate them.