Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

51–60 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#51

Post by pwg »

cheald wrote: post #39
Trasmatta wrote: post #25

Earlier quoted context omitted.

> People take the path of least resistance; we know this If you remove the ability to store 2FA codes in password managers, the path of least resistance becomes "people don't use 2FA at all".

I don't think that's true at all. 2FA has been a popular solution for many years, well before the addition of TOTP support to the popular password managers.

For some sizable amount of the user base, assuming they can even be convinced to use a password manager in the first place, not being able to also store 2FA codes in the manager will become their excuse to not use 2FA codes.

A great expanse of users (note, not normally the ones who frequent HN) see all these 2FA codes, and passwords as well, as just an irritating impediment to accomplishing whatever goal it is they wish to accomplish at the time.

Re: Why does storing 2FA codes in your password manager make sense?

#52

Post by watermelon0 »

nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

If you store both in one place, it's similar to 1FA. In such case it's a lot better to just use passkeys (where supported).

Re: Why does storing 2FA codes in your password manager make sense?

#53

Post by pwg »

rlk wrote: post #29
declan_roberts wrote: post #5

Earlier quoted context omitted.

Exactly, and is there material difference between OTP in a password manager and a passkey in the password manager?

There are a couple of differences: 1. While a password manager should associate a TOTP seed with a domain and only fill codes on that domain, the codes are still visible to you. A convincing phishing attack might trick you into manually entering a code into a fake page. Passkeys don't allow this. 2. TOTP codes are derived from a seed shared between the client and server, so an attacker who gets read access to the ser…

> A convincing phishing attack might trick you into manually entering a code into a fake page.

Sadly, for a far too large population of users, a convincing phishing attack will be successful, even if the tech. is flashing ten different warnings of "this is a phishing attack page" at the same time. You can't "technology" around human nature for a subset of the population.

Re: Why does storing 2FA codes in your password manager make sense?

#54

Post by 01HNNWZ0MV43FF »

WXLCKNO wrote: post #48
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

After seeing people lose cryptocurrency first hand through the LastPass leaks (hot wallet seed phrases, which is still stupid to have online but..), I really feel like the odds of a leak being the cause of any issues higher than a bad password, for tech savvy security conscious users at least.

Wasn't that because they had backed up their password vaults to LastPass' cloud service?

I use KeePass, never upgrade it, and only back it up to my own cold spinning drives. If malware stole my local vault I'd be in trouble, but it's more convenient than keeping my passwords on paper.

Re: Why does storing 2FA codes in your password manager make sense?

#55

Post by ziml77 »

jasonjayr wrote: post #45
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you. At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.

Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.

Re: Why does storing 2FA codes in your password manager make sense?

#56

Post by baobabKoodaa »

conception wrote: post #21

Using 1Password requires me to use one of my devices to add a device to my account. If someone has my password and my device how will a separate app help me in this case? Honest question as the 1password model seems to be “something you know and something you have”.

If someone hacks 1Password, they will get access to all your accounts. Whereas if you moved TOTP off 1Password, that hacker would no longer be able to access your accounts.

Re: Why does storing 2FA codes in your password manager make sense?

#57

Post by clysm »

1970-01-01 wrote: post #31

I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?

> There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault.

Did you read the article? That's what they say.

> For maximum security, you can store your 2FA token elsewhere ... but for general purpose use, storing your 2FA in your password manager is an acceptable solution due to the convenience benefits it provides.

Re: Why does storing 2FA codes in your password manager make sense?

#58

Post by connicpu »

WXLCKNO wrote: post #48
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

After seeing people lose cryptocurrency first hand through the LastPass leaks (hot wallet seed phrases, which is still stupid to have online but..), I really feel like the odds of a leak being the cause of any issues higher than a bad password, for tech savvy security conscious users at least.

Part of why I avoid password managers that use their own cloud system. Storing my vault in a regular cloud database, not a password-specific one, to me makes it much less likely my vault will be compromised.

Re: Why does storing 2FA codes in your password manager make sense?

#59

Post by taviso »

Scion9066 wrote: post #37
taviso wrote: post #26

I'm not familiar with the expert they consulted, but the claim that "The main advantage of 2FA is that it is much more difficult to gain access to your accounts via phishing attacks" is just plain false. TOTP or SMS-2FA are obviously phishable, if you just entered your password into a phishing site, why wouldn't you also enter a TOTP code? I usually point to Modlishka as a practical example ( https://vimeo.com/308709…

I think their point was that it's less phishable from the perspective of needing the attacker to try logging into the site with it in realtime instead of being able to just store the password for some later time. The needed concurrency makes it more difficult (if only slightly). I'm curious though why you don't think TOTP or similar are good against credential stuffing though, would you be able to expand upon that?

The attacker doesn't need to literally be sitting at a keyboard, that can just be automated.

> I'm curious though why you don't think TOTP or similar are good against credential stuffing though

I have written about this before, but looks like I lost the article somehow. https://web.archive.org/web/20210219185711/https://blog.cmpx...

Imagine you reuse the same password everywhere, and are sick of credential stuffing attacks. You ask your friend for advice, and your friend tells you to just enable TOTP when available, explaining that when there is a data breach you will be safe.

That is obviously bad advice, the vast majority of services do not use TOTP and you will have to race attackers to change your credentials quickly at dozens (hundreds?) of services. I think a reasonable person would say that you have not "prevented" credential stuffing.

A far better solution is unique passwords, it works today with all service providers.

Re: Why does storing 2FA codes in your password manager make sense?

#60

Post by crazygringo »

watermelon0 wrote: post #52
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

If you store both in one place, it's similar to 1FA. In such case it's a lot better to just use passkeys (where supported).

Good point about it being similar to passkeys.

But why would it be better to use passkeys?

Because don't sites with passkeys generally still allow you to fall back to password, since it's common for people to lose their phone and then lose their passkey? Whereas sites with 2FA obviously don't, and have more complicated/secure recovery mechanisms?

So seems to me like 2FA (TOTP's) are currently vastly better in practice?

Post reply on HN