Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

41–50 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#41

Post by Scion9066 »

sneak wrote: post #38
1970-01-01 wrote: post #31

I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?

The most common 2FA mobile app that isn’t a password manager is Google Authenticator. Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Also, TOTP in general is bad, because it is easily phished, just like passwords. Using a password manager to store TOTP cuts down on phishing risk as it won…

Google Authenticator does support exporting and syncing now:

https://security.googleblog.com/2023/04/google-authenticator...

Re: Why does storing 2FA codes in your password manager make sense?

#42

Post by doodlesdev »

sneak wrote: post #38
1970-01-01 wrote: post #31

I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?

The most common 2FA mobile app that isn’t a password manager is Google Authenticator. Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Also, TOTP in general is bad, because it is easily phished, just like passwords. Using a password manager to store TOTP cuts down on phishing risk as it won…

> Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad.

Not true anymore. [0]

[0]: https://www.theverge.com/2023/4/24/23696058/google-authentic...

Re: Why does storing 2FA codes in your password manager make sense?

#43

Post by xlii »

This might not be solution for everyone but wouldn’t the best protection to use two separate password managers? One for passwords and the other for the TOTPs?

I wonder why service providers don't have it already. They could even help ensuring that the passwords are different and provide some interoperability between both vaults (e.g. TOTP on mobile device is passed to PC password completions)

Re: Why does storing 2FA codes in your password manager make sense?

#44

Post by dahart »

throwpoaster wrote: post #11

I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.

Wild! Would that actually work in the long run? It could cause you a lot of trouble, I’m sure, but it seems like if you have any legal documentation, a lawyer would easily fix it. And it seems like it’s probably illegal to try to remove someone without consent or authorization, so it could potentially backfire pretty hard for him?

I know this happens sometimes, and I’m thankful my partnerships have never gone this bad. Did you know it was headed this direction before he tried it? Was that the end of the company?

Re: Why does storing 2FA codes in your password manager make sense?

#45

Post by jasonjayr »

nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you.

At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.

Re: Why does storing 2FA codes in your password manager make sense?

#46

Post by pwg »

sneak wrote: post #38
1970-01-01 wrote: post #31

I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?

The most common 2FA mobile app that isn’t a password manager is Google Authenticator. Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Also, TOTP in general is bad, because it is easily phished, just like passwords. Using a password manager to store TOTP cuts down on phishing risk as it won…

FreeOTP+, available on FDroid [1] provides for import/export of one's stored codes.

The problem with "phishing" is not the technology. Phishing is 100% a human issue and no matter what tech. you might use, those humans vulnerable to being phished will find a way to be phished.

[1] https://f-droid.org/en/packages/org.liberty.android.freeotpp...

Re: Why does storing 2FA codes in your password manager make sense?

#47

Post by alehlopeh »

watermelon0 wrote: post #35
_1tem wrote: post #18

Important to note that not all password managers are equal. Using Apple’s built-in password manager is more secure because it is inherently tied to your biometrics and authentication is hardware-based, i.e Secure Enclave. This is categorically different from web services like Bitwarden or 1Password authenticated by login email and 2FA codes. Even if someone got into your Apple ID they still would be unable to view or…

iCloud syncs passwords between your devices. If someone can login via your Apple ID, which means that the person knows username/password, and can also convince you to provide them with 2FA code that gets shown on your existing device, they can just add a new device to your account, and get passwords to sync to it.

If someone knows your username and password and can convince you to give them a TOTP code, then yeah they can log in to your account. That’s hardly iCloud-specific.

Re: Why does storing 2FA codes in your password manager make sense?

#48

Post by WXLCKNO »

nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

After seeing people lose cryptocurrency first hand through the LastPass leaks (hot wallet seed phrases, which is still stupid to have online but..), I really feel like the odds of a leak being the cause of any issues higher than a bad password, for tech savvy security conscious users at least.

Re: Why does storing 2FA codes in your password manager make sense?

#49

Post by watermelon0 »

eblume wrote: post #33
taviso wrote: post #26

I'm not familiar with the expert they consulted, but the claim that "The main advantage of 2FA is that it is much more difficult to gain access to your accounts via phishing attacks" is just plain false. TOTP or SMS-2FA are obviously phishable, if you just entered your password into a phishing site, why wouldn't you also enter a TOTP code? I usually point to Modlishka as a practical example ( https://vimeo.com/308709…

The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password. Your point that if you've already decided to enter your password then entering the 2FA code isn't much of a hurdle is sound, but from the perspective of a user of 1Password, it is indeed very surprising (and rare!) when I try to log in to a page and find that 1Password won't show my lo…

If domain doesn't match, password manager of choice will not suggest to populate credentials. In that case it doesn't matter if 2FA is saved by the password manager, or is managed on another device, because you won't have the chance to use the 2FA.

If domain doesn't match, and you manually copy the password, and login, you can as well manually copy the 2FA code.

Re: Why does storing 2FA codes in your password manager make sense?

#50

Post by baobabKoodaa »

1970-01-01 wrote: post #31

I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?

Same here. It seems like they are very narrowly optimizing for the extremely rare case of a person who simultaneously:

A) Is fooled by a phishing attack

and

B) Is not fooled enough to manually copy-paste credentials from their password manager after noticing that the autofill didn't work

Does a person like this exist somewhere? Sure, if you interview 1 million people, I'm sure you will find 1 person like this.

It is very, very strange to me that the security "experts" are narrowly optimizing for this specific user and downplaying all the risks related to their recommendation.

Post reply on HN