4 ms·

If all the factors are on the same box, it's just one factor.

• manicdee 10y ago
  The main concern for people using TOTP from a password vault is attacks against the websites they are visiting, not compromise of their password vault. So no, the two factors are not on the same box being attacked, in the threat modes of interest. For the threat of "my stuff was stolen" then both factors are in the same box, so even having a separate piece of hardware is no use (unless you can convince the thief to not take everything and please leave the authenticator dongle behind).
  • duaneb 10y ago
    > The main concern for people using TOTP from a password vault is attacks against the websites they are visiting, not compromise of their password vault. Well, if they gain access to your machine, they can't access your iphone. Or yubikey. Just don't kid yourself—you use the same password for everything, and that's your only factor.