Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

61–70 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#61

Post by baobabKoodaa »

clysm wrote: post #57
1970-01-01 wrote: post #31

I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?

> There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. Did you read the article? That's what they say. > For maximum security, you can store your 2FA token elsewhere ... but for general purpose use, storing your 2FA in your password manager is an acceptable solution due to the convenience benefits it provides.

> Did you read the article? That's what they say.

No, that's not what they say. If you read the text that you just now quoted, you will see that it says "storing your 2FA in your password manager is an acceptable solution due to the convenience benefits it provides". Clearly the writer of that text believes there _is_ something wrong with having 2FA completely separate from the password vault: it is less convenient, to the extent where they are happy recommending this horrible approach to laypersons.

In addition, if you go and read OP, you will find that they talk about the potential of losing access to your TOTP codes stored in Google Authenticator. So that's another thing that counts as "something wrong" with storing 2FA separately from password vault.

So there's at least 2 things in the article that count as "something wrong". So they definitely didn't say that there's "absolutely nothing wrong".

Re: Why does storing 2FA codes in your password manager make sense?

#62

Post by Spooky23 »

nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

TOTP tokens aren’t really MFA anyway. They are just another type of password that is more protecting against bad password practices and other compromises. They deliver multi-step auth.

Tokens that increase the trust level of an authentication come with additional controls (tamper resistant hardware, passcode, etc)

For normal people, a FIDO token delivers the highest level of security and integrity.

Re: Why does storing 2FA codes in your password manager make sense?

#63

Post by gchamonlive »

It's better than not having 2fa, but a breach to your password manager would give any attacker full control over your accounts.

A better approach would be to split in two solutions where you store passwords and 2fa keys.

I use bitwarden for passwords, but save all 2fa in aegis. These two have different 5 word passphrases prefixed with a regular 8 char password to increase entropy. I save a backup of the 2fa db to a replicated storage with a synthetic password. For bitwarden I delegate persistence of the data to bitwarden, but it would make sense to take encrypted backups regularly.

The disaster recover protocol is to have a smaller 2fa encrypted database printed in paper. I know the password to this db. Recovering this DB gives me access to bitwarden and the cloud storage, which gives me access to the rest of my password and keys.

Re: Why does storing 2FA codes in your password manager make sense?

#64

Post by kif »

People advocating against storing 2FA codes in the password manager are correct from a purist perspective, but not from a pragmatic perspective if you ask me.

If my device is compromised, along with my device's password, as well as the password manager's password, then yeah... I'm screwed.

As long as I keep my devices up-to-date though, I believe the highest risk comes from state-sponsored actors. I've chosen convenience, and I've made my peace with it.

Re: Why does storing 2FA codes in your password manager make sense?

#65

Post by complex_pi »

A file-based password manager ils something you have (the file) and something you know (the master password) provided you have a timeout on the password manager and a safe screensaver. (In reply to some comments below).

It does require some thought / hygiene but seems a fair compromise.

Re: Why does storing 2FA codes in your password manager make sense?

#66

Post by skybrian »

More generally: the world would be a better place if most people relied on password managers. If you can do it reliably, using any password manager, even the one built into your browser or OS, is better than not using one.

The problem is that it requires a certain amount of good hygiene when it comes to computer equipment. There are many people who are bad with computers, who don’t have phone backups and lose their phone, who will share accounts and devices, and so on. The result is an insecure mess.

So, solving the “people should use a password manager” problem requires solving all the other issues surrounding how non-technical people use and misuse computer equipment, so that having a password manager and not losing the essential data stored in it becomes the default.

For some people, it would probably be safer and easier to write down your passwords on paper, in a notebook. Other people will lose the notebook, or have it stolen from them. There are similar but more complicated issues with holding onto computer devices.

Re: Why does storing 2FA codes in your password manager make sense?

#67

Post by mid-kid »

The reason I store 2FA codes in my password manager is as a protest to companies forcing me to have a 2FA. I don't want to be randomly locked out of my google account due to not having a usable 2FA, and I also don't want to depend on having a single device be always available to provide the codes.

In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwords for every service. The phishing-resistance is nice, but I'd prefer it being the only credential, and just having it be autofilled (making it longer to combat bruteforce), like what we currently have with password managers...

Here's to hoping passkeys turn out any better.

Re: Why does storing 2FA codes in your password manager make sense?

#68

Post by bluGill »

ziml77 wrote: post #55
jasonjayr wrote: post #45

Earlier quoted context omitted.

The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you. At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.

Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.

The password is generally the weak point. If you can remember it any modern computer can guess it in a short time. Which is why password generation is so imporant.

Re: Why does storing 2FA codes in your password manager make sense?

#69

Post by jopsen »

I really wish we could store passkeys and totp in bitwarden where access always goes through a server side KMS.

Currently, bitwarden stores these encrypted, but they are unlocked with the rest of the password manager.

For now I'll stick to yubikey for 2FA.

But I wish I could use bitwarden as a layer of abstraction, such that bitwarden would always require my yubikey before allowing any of the passkeys or totp keys to be used.

Post reply on HN