4 ms·
It mitigates passive attacks: If someone spies me entering the password (by keylogger or in person) they only get my password but cannot login 2 minutes later (
by lixtra 7y ago
It mitigates passive attacks: If someone spies me entering the password (by keylogger or in person) they only get my password but cannot login 2 minutes later (TOTP tokens should not be reusable for some time, so even this 1 minute window gets closed).
Plus, some buerocrat can tick the 2FA box.
- tptacek 7y agoRight, but you're mitigating an extremely marginal attack (a purely passive interception of a login) and enabling a somewhat more realistic attack, and for what? If you're just doing it to fake out 2FA requirements, sure, do whatever. But otherwise, just use 1Password passwords and skip the TOTP theater.
- lixtra 7y agoPassword leakage is not a marginal problem. I find saved passwords in public browsers all the time. Those with TOTP are much better protected against this as well.
- the_common_man 7y agoYeah, but you are not finding 1Password passwords in public browsers, are you?
- lixtra 7y agoSadly, I found ones from colleagues that use 1Password and even to me it happened that I clicked save for password that I didn’t want to save in that environment.
- giobox 7y ago1Password also has a web UI, so yes it is still very possible to copy a password from 1Password and accidentally save it on a public browser. Not to mention the simplest: type in password from 1Password on phone on public browser. Accidentally save password.
- ensignavenger 7y agoHo does having TOTP in addition to a password versus just the password enable a more realistic attack?
- reificator 7y ago> Right, but you're mitigating an extremely marginal attack (a purely passive interception of a login) and enabling a somewhat more realistic attack, and for what? If you're just doing it to fake out 2FA requirements, sure, do whatever. But otherwise, just use 1Password passwords and skip the TOTP theater. Passive interception is not the only possibility. How many password dumps show up each year? Having TOTP enabled, regardless of where it is stored, helps mitigate that threat unless the password that is leaked can also access whatever is storing your TOTP secrets. But if you're using a password manager and reusing passwords, I don't know what to tell you. Personally I use a TOTP implementation that lets me move the backing store as a file. It's not stored in my password manager, but it's available to me should I need to change phones. That seems like the best of all worlds.