Why does storing 2FA codes in your password manager make sense?
andygrunwald.com
Why does storing 2FA codes in your password manager make sense?
1–10 of 147 posts
Re: Why does storing 2FA codes in your password manager make sense?
#2TLDR: Account security is a balance and saving it in a password manager has more benefits than downsides
Re: Why does storing 2FA codes in your password manager make sense?
#3Because there's a trade-off between security and convenience.
Re: Why does storing 2FA codes in your password manager make sense?
#4Related: Why is it a good idea to store 2FA tokens in 1Password?
Re: Why does storing 2FA codes in your password manager make sense?
#5Because there's a trade-off between security and convenience.
Exactly, and is there material difference between OTP in a password manager and a passkey in the password manager?
Re: Why does storing 2FA codes in your password manager make sense?
#6Because there's a trade-off between security and convenience.
Exactly, and is there material difference between OTP in a password manager and a passkey in the password manager?
Probably.
I would bet there are some systems that accept a passkey in a situation that they don't accept a password.
Re: Why does storing 2FA codes in your password manager make sense?
#7I store 2FA keys in a fingerprint protected Aegis vault on my phone, and I periodically export an encrypted (with a master password I remember) backup that I then email to my parents.
I get their argument that 2FA makes phishing more difficult, but I disagree that it's its "primary use", or that the distributed factor is unimportant. I personally wouldn't feel comfortable having all my important accounts behind Bitwarden's single point of failure. 2FA for important accounts mitigates the damage if my Bitwarden is broken into.
Re: Why does storing 2FA codes in your password manager make sense?
#8>A time-based 2FA (TOTP) is time-sensitive, and a man-in-the-middle or proxy needs to be set up to capture that in real-time
Is that supposed to be remotely difficult? It'll take maybe an hour to whip up a script that takes the captured credentials, passes it onto a headless browser to attempt the login, capture the session cookie, and optionally refresh the page regularly to keep the session active.
Re: Why does storing 2FA codes in your password manager make sense?
#9You may say I am a dreamer, but I am not the only one!
Storing 2FA codes in your password manager is not a good idea at all in case you get it breached. Otherwise it could be a convenient idea.
If your password manager gets breached you could also loose control of your 2FA as it can be replaced as well.
We need to securely store our 2FA codes, sure. But I would advise not to use the "normal" password manager. I for use have them printed on paper.
Re: Why does storing 2FA codes in your password manager make sense?
#10I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and, significantly worse, it's "something you know in the same place as the other thing you know".
The time-variant component is still quite valuable, but it does nothing to protect you in the event of a password manager compromise. This is not a hypothetical; LastPass has suffered multiple breaches, and the more popular a solution, the more likely there are to be attacks against that solution. By keeping your 2FA separate from your password manager, even if it's still just "something you know", it's something you know in a location that's orthogonal to your passwords. If I yield to convenience and use a 2FA desktop app, then now, instead of just attacking my Bitwarden install, you have to successfully attack my Bitwarden install and my 2FA desktop app install to get access to my accounts, and the combination of password managers * 2FA managers is a substantially larger attack surface and requires a significantly more sophisticated attack to get both pieces.
The arguments in the article come down to "well, 2FA mitigates phishing attacks" (true) and "Google Authenticator means you can lose your data easily" (also true). But neither of these is a good argument for why the data should be kept together. It just means "use 2FA", and "use a 2FA manager that lets you directly manage your seeds and keep offsite encrypted backups".
If you can't be bothered to do it properly, then 2FA codes in your password manager is certainly better than not using 2FA at all, but that just makes it a less terrible solution, not a good one.