Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does storing 2FA codes in your password manager make sense?

andygrunwald.com

Post reply on HN
Print view View original

81–90 of 147 posts

Re: Why does storing 2FA codes in your password manager make sense?

#81

Post by baliex »

bluGill wrote: post #68
ziml77 wrote: post #55

Earlier quoted context omitted.

Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.

The password is generally the weak point. If you can remember it any modern computer can guess it in a short time. Which is why password generation is so imporant.

> If you can remember it any modern computer can guess it in a short time.

That's not true. A long sentence of your choosing is easy to memorise and plenty long enough to not be able to be guessed by a computer (brute force).

Re: Why does storing 2FA codes in your password manager make sense?

#82

Post by alistairSH »

Maybe there’s a language issue here… but would any saved 2FA code be expired the next time you retrieved it from your password manager? They’re generated for one-time use and have an expiration, right?

Or, when the author says “save the 2FA code” does he really mean “use the password manager to generate the 2FA codes”?

Re: Why does storing 2FA codes in your password manager make sense?

#83

Post by ghjfrdghibt »

jasonjayr wrote: post #45
nlawalker wrote: post #12

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It'…

The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you. At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.

Or you can protect the database with a keyfile and/or a hardware key meaning you need 2 or 3 factors for the database.

This is what I do for my keepass database. It means I can store my database in a cloud service of my choice for sync purposes too.

Re: Why does storing 2FA codes in your password manager make sense?

#84

Post by Eric_WVGG »

A good explanation for the layperson is: MFA means access requires something you know (a password) and something you have.

In the early days of MFA that thing meant a cellphone because it was SMS by default, but yeah, a laptop or computer of any kind is a "thing you have" as well.

Re: Why does storing 2FA codes in your password manager make sense?

#85

Post by yoble »

bluGill wrote: post #68
ziml77 wrote: post #55

Earlier quoted context omitted.

Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.

The password is generally the weak point. If you can remember it any modern computer can guess it in a short time. Which is why password generation is so imporant.

I don't think that's correct as a blanket statement - you can use a passphrase, or remember a 14+ character password since you only have one to remember.

Even if it's only random-ish, password managers do key stretching (for example by hashing the password 600k times - bitwarden has a high default value and lets you increase it if you like) so that it has to take some computational effort to check if a single password is correct. That's why it take a few seconds to unlock your vault each time.

With these in place I think you're pretty safe for a long time. (Well, maybe until quantum computing breaks those cyphers?)

Re: Why does storing 2FA codes in your password manager make sense?

#86

Post by Eric_WVGG »

throwpoaster wrote: post #11

I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.

That’s harrowing.

If any journalists are lurking in this discussion, this would make a decent article.

Re: Why does storing 2FA codes in your password manager make sense?

#87

Post by aftbit »

IMO the real advantages of 2FA are threefold:

1. The key is generated by the server, not the client (human), so it cannot be reused like a password.

2. The authentication is temporally bound, so phishing only offers access for ~30 seconds, unlike a password where it provides unlimited access until someone changes it (never unless forced in practice).

3. It's literally required for many services, so you need to use it. The alternatives to storing your secrets in your password manager are keeping them on your phone (which is how most people log in anyway, so its already becoming a single point of failure) or using something like SMS 2FA, which is even worse as SIM jacking is pretty trivially possible on most providers.

Re: Why does storing 2FA codes in your password manager make sense?

#88

Post by jamesmotherway »

crazygringo wrote: post #60
watermelon0 wrote: post #52

Earlier quoted context omitted.

If you store both in one place, it's similar to 1FA. In such case it's a lot better to just use passkeys (where supported).

Good point about it being similar to passkeys. But why would it be better to use passkeys? Because don't sites with passkeys generally still allow you to fall back to password, since it's common for people to lose their phone and then lose their passkey? Whereas sites with 2FA obviously don't, and have more complicated/secure recovery mechanisms? So seems to me like 2FA (TOTP's) are currently vastly better in practic…

Hardware keys and passkeys are better because they can't be phished. In the case of hardware keys, one should register multiple to prevent lockout. Most implementations of passkeys seem to be portable, letting them exist on multiple devices (something that gives me pause).

If an adversary can successfully phish someone, they can often also trick them into providing TOTP codes or approving push notifications. However, TOTP remains significantly better than the alternatives, as it prevents credential stuffing attacks and SMS-related compromises while potentially limiting any account breach to a single session.

Re: Why does storing 2FA codes in your password manager make sense?

#89

Post by cycomanic »

baobabKoodaa wrote: post #61
clysm wrote: post #57

Earlier quoted context omitted.

> There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. Did you read the article? That's what they say. > For maximum security, you can store your 2FA token elsewhere ... but for general purpose use, storing your 2FA in your password manager is an acceptable solution due to the convenience benefits it provides.

> Did you read the article? That's what they say. No, that's not what they say. If you read the text that you just now quoted, you will see that it says "storing your 2FA in your password manager is an acceptable solution due to the convenience benefits it provides". Clearly the writer of that text believes there _is_ something wrong with having 2FA completely separate from the password vault: it is less convenient,…

They say it's less convenient, that doesn't mean they say it's wrong. And yes it is less convenient, why are you saying it's "horrible"? Security is always about compromises, if the less convenient method causes people to come up with workarounds then it would be worse even if in theory it's more secure.

Re: Why does storing 2FA codes in your password manager make sense?

#90

Post by ww520 »

sneak wrote: post #38
1970-01-01 wrote: post #31

I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?

The most common 2FA mobile app that isn’t a password manager is Google Authenticator. Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Also, TOTP in general is bad, because it is easily phished, just like passwords. Using a password manager to store TOTP cuts down on phishing risk as it won…

For Google Authenticator, you can do an export for device migration. Once it shows the QR code image, snap it and then abort the migration. Back up the QR code for later restoration.
Post reply on HN