For a few years I've used the exact same setup as the author in regards to my TOTP codes, password manager, and WebAuthn hardware keys. This past year, I've supplemented this with biometric passkeys on Windows, Apple, and Android.
Why does storing 2FA codes in your password manager make sense?
91–100 of 147 posts
Re: Why does storing 2FA codes in your password manager make sense?
#92The reason I store 2FA codes in my password manager is as a protest to companies forcing me to have a 2FA. I don't want to be randomly locked out of my google account due to not having a usable 2FA, and I also don't want to depend on having a single device be always available to provide the codes. In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwo…
Passkeys are a shitshow at the moment, I store passkeys in my password manager along with 2fa codes as it is the only way to make them reasonably usable. And obviously the only other way to manage passkeys is to rely either on a single device, trust big corps and vendor lock in, or to have multiple passkeys on multiple devices/services for the same sites/accounts.
Re: Why does storing 2FA codes in your password manager make sense?
#93I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?
Same here. It seems like they are very narrowly optimizing for the extremely rare case of a person who simultaneously: A) Is fooled by a phishing attack and B) Is not fooled enough to manually copy-paste credentials from their password manager after noticing that the autofill didn't work Does a person like this exist somewhere? Sure, if you interview 1 million people, I'm sure you will find 1 person like this. It is…
In my previous company we hired a startup that did security training, that recommanded everyone use a password manager. And one of their test was that they sent a fake phishing email to people (randomized over a couple of months so not everyone would get it the same day).
I don't remember the exact number but something like 30% of people who didn't use a password manager got caught. Basically no-one using a manager was.
Granted there might be some selection bias (people who had managers were probably already slightly more security conscious), but people were feeling slightly embarrassed to have been caught and it worked great to have everyone do the switch. And everyone remembered after that that if it doesn't autofill, something's amiss.
Re: Why does storing 2FA codes in your password manager make sense?
#94One of the risks of 2FA is losing access to your accounts after losing the authenticating device. Backing up the 2FA seeds mitigates that risk. The backup needs to be encrypted with the password remembered and stored somewhere. Sounds like it’s a job for a password manager, preferably in an offline local password manager with a different database.
"One of the risks of 2FA is losing access to your accounts after losing the authenticating device."
A "2FA Mule"[1] solves this problem by staying in one place with constant power.
I receive plain old SMS 2FA codes while flying in an airplane.
I also don't care that much if I lose or destroy my personal mobile. In fact, I don't even know my current SIM number. If I lose my personal mobile I just edit a twiml bin at Twilio and point my number somewhere else ...
Re: Why does storing 2FA codes in your password manager make sense?
#95>A time-based 2FA (TOTP) is time-sensitive, and a man-in-the-middle or proxy needs to be set up to capture that in real-time Is that supposed to be remotely difficult? It'll take maybe an hour to whip up a script that takes the captured credentials, passes it onto a headless browser to attempt the login, capture the session cookie, and optionally refresh the page regularly to keep the session active.
Unless the page gives you a captcha before the TOTP, which it definitely should.
None of my bank accounts use a login captcha. Presumably they mitigate bruteforcing using lockouts or similar. Even if they use captchas, captcha solving services exist that solve for less than a cent per solve. It's not a huge barrier.
Re: Why does storing 2FA codes in your password manager make sense?
#96It's interesting how many argue that putting 2FA codes into a password manager is wrong because you combine 2 factors into one (not don't fully agree with that reasoning), but then are happy with passkeys. How are passkeys better?
Passkeys aren't susceptible to phishing. 2FA TOTP is. Also -your seed/token can be trivially stolen from a password manager. Getting the passkey private key somewhat more challenging.
Re: Why does storing 2FA codes in your password manager make sense?
#97I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and , significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quit…
> it does nothing to protect you in the event of a password manager compromise. This is not a hypothetical; LastPass has suffered multiple breaches, and the more popular a solution, the more likely there are to be attacks against that solution.
You can mitigate this risk by not depending on your password manager app to do cross-device sync..keep a file on Dropbox/OneDrive/iCloud Drive/SFTP/etc and use an app like KeePass/Strongbox/etc that just deals in managing credentials.
My KeePass file storage provider doesn't know what the hell I store there because it's encrypted (I hope there are no known issues with KeePass's crypto)
As a bonus, you can keep offline backups to mitigate other risks like house fire, lightning strike induced EMP frying things (happened to me), storage vendor goes out of business, and more.
-------------
I think in the end, there is no universal solution - you really have to try to be reasonable about estimating your own personal threats and risks (such as asking "am I more likely to suffer a password manager compromise or more likely to break a device?") to decide whether to keep 2FA next to passwords or not.
Re: Why does storing 2FA codes in your password manager make sense?
#98I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and , significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quit…
Putting your 2FA into your password manager doesn't "reduce" it to "something you know". It proves it was "something you know" all along. If it can be put into a password manager, it's "something you know", regardless of what the intention is or was. Intentions don't drive what things actually are. On a related notes, "passkeys" are also "something you know" for the same reason. However, that does not mean that TOTP…
> If it can be put into a password manager, it's "something you know", regardless of what the intention is or was. Intentions don't drive what things actually are.
That's not a useful distinction and needlessly breaks an otherwise useful model. By that logic, every authentication method is just "something you know" since every piece of information can be represented as a stream of bits, and password managers are well equipped for storing it. That includes your face, fingerprint, and DNA.
Re: Why does storing 2FA codes in your password manager make sense?
#99>A time-based 2FA (TOTP) is time-sensitive, and a man-in-the-middle or proxy needs to be set up to capture that in real-time Is that supposed to be remotely difficult? It'll take maybe an hour to whip up a script that takes the captured credentials, passes it onto a headless browser to attempt the login, capture the session cookie, and optionally refresh the page regularly to keep the session active.
Unless the page gives you a captcha before the TOTP, which it definitely should.
Modern captchas only deter humans, bots will pass right through.
Re: Why does storing 2FA codes in your password manager make sense?
#100More generally: the world would be a better place if most people relied on password managers. If you can do it reliably, using any password manager, even the one built into your browser or OS, is better than not using one. The problem is that it requires a certain amount of good hygiene when it comes to computer equipment. There are many people who are bad with computers, who don’t have phone backups and lose their p…
Isn’t this what passkey is trying to sidestep? Assuming the user is at least authenticated on one device.
For people who are bad with computers, I think passkeys could work ok in scenario where somebody has just one device, they never upgrade it, never lose it, never break it, never accidentally click on "log out" in their passkey provider's account.