Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

71–80 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#71

Post by patrakov »

cheald wrote: post #10

I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and , significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quit…

Unconventional opinion here.

Passwords in the password manager are not "something you know" anymore. They are "something you have". So, no matter whether the TOTP codes are stored in the same app or a separate device, you can no longer properly call them 2FA. It's 2x "something you have" in either case.

EDIT: user "jerf" in the same comment thread says that it is 2x "something you know". The distinction whether something stored counts as "something you know" or "something you have" does not really matter. In either case, it is 2x the same type of a factor. --END EDIT.

From the "difficulty to compromise something" standpoint, you are, of course, right that storing the TOTP seed in a separate device is better. But look, this is not the primary reason why websites need to implement TOTP. The very fact that hackers need to compromise your device in order to get access to your account is already indicating a higher-than-usual security level, even without 2FA, and the article fails to notice this. Besides, the article only presents a user-centric viewpoint, while the viewpoint of a website owner would be more relevant here.

The main problem solved for real by TOTP is that users select stupid passwords like "Zhong+wen" that are guessable yet still pass complexity requirements, or reuse passwords on multiple websites (and your website cannot check for that), thus enabling compromise of the user's account on your website if another website gets hacked.

The main security reason (from the website viewpoint, not from the user's viewpoint) for TOTP introduction is, thus, to introduce a high-entropy factor which is (unlike a password) not chosen by the user, guaranteed not to be reused elsewhere, and thus cannot be guessed or compromised without access to the user's devices. This benefit is not invalidated by you storing the 2FA secret in the password manager.

Re: Why does storing 2FA codes in your password manager make sense?

#72

Post by hackerbrother »

Ultimately, you have to store your backup codes somewhere. So the only solution besides using your password manager is using a second password manager. Or not using a password manager to save off your backup codes, which has its own disadvantages.

There's lots of cases where 2FA reduces to 1FA. E.g. logging into a website on your mobile phone, and getting your TOTP or SMS code on that same phone. In fact-- that case is so common I wonder if we should just get more used to the idea of 1FA, with smartphone passkeys/biometrics/SSO being the auth factor. As it stands, if you compromise someone's smartphone (and have their smartphone PIN), the odds are great you can autofill any password you like on their phone and pull up any needed 2FA tokens as well.

Re: Why does storing 2FA codes in your password manager make sense?

#73

Post by loeg »

mid-kid wrote: post #67

The reason I store 2FA codes in my password manager is as a protest to companies forcing me to have a 2FA. I don't want to be randomly locked out of my google account due to not having a usable 2FA, and I also don't want to depend on having a single device be always available to provide the codes. In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwo…

> In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwords for every service.

Right. This is the killer features of passkeys.

Re: Why does storing 2FA codes in your password manager make sense?

#74

Post by raywu »

skybrian wrote: post #66

More generally: the world would be a better place if most people relied on password managers. If you can do it reliably, using any password manager, even the one built into your browser or OS, is better than not using one. The problem is that it requires a certain amount of good hygiene when it comes to computer equipment. There are many people who are bad with computers, who don’t have phone backups and lose their p…

Isn’t this what passkey is trying to sidestep? Assuming the user is at least authenticated on one device.

Re: Why does storing 2FA codes in your password manager make sense?

#75

Post by Trasmatta »

cheald wrote: post #39
Trasmatta wrote: post #25

Earlier quoted context omitted.

> People take the path of least resistance; we know this If you remove the ability to store 2FA codes in password managers, the path of least resistance becomes "people don't use 2FA at all".

I don't think that's true at all. 2FA has been a popular solution for many years, well before the addition of TOTP support to the popular password managers.

Was it actually popular among non tech people? I feel like nobody I knew outside of developers had ever used a 2FA code until maybe 3 or 4 years ago (unless they were forced to)

Re: Why does storing 2FA codes in your password manager make sense?

#76

Post by starky »

Al-Khwarizmi wrote: post #14
cheald wrote: post #10

I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and , significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quit…

You speak as if 2FA were something that most people use willingly and not just something they put up with because they're forced to.

I agree. Give the average person the ability to make a good enough decision for their online security with minimal effort. I'm having a hard time being that concerned with TOTP 2FA being an option in the same location as passwords when the most important accounts people have are often limited to completely unacceptable SMS 2FA (looking directly at you financial institutions). Whatever it takes to get people off SMS and Email 2FA is a big win in my book, even if it isn't the best option.

Re: Why does storing 2FA codes in your password manager make sense?

#77

Post by ww520 »

One of the risks of 2FA is losing access to your accounts after losing the authenticating device. Backing up the 2FA seeds mitigates that risk. The backup needs to be encrypted with the password remembered and stored somewhere. Sounds like it’s a job for a password manager, preferably in an offline local password manager with a different database.

Re: Why does storing 2FA codes in your password manager make sense?

#80

Post by jamesmotherway »

watermelon0 wrote: post #52
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

If you store both in one place, it's similar to 1FA. In such case it's a lot better to just use passkeys (where supported).

If the vault requires a hardware key and master password to access the encrypted password and token, would you still describe it as single-factor authentication?
Post reply on HN