3 ms·
It isn't much of a second factor if it is the same factor as your password.
by zokier 7y ago
It isn't much of a second factor if it is the same factor as your password.
- dastx 7y agoBut the point it protects against is if a website a password belongs to is compromised. If your password manager is compromised, then yes, it is game over. But by that logic, if your password manager and your otp manager is compromised (which often live on the same phone) you haven't mitigated much.
- bscphil 7y agoYou can make an argument for a second factor (other than hardware key) being of fairly little value to anyone using an offline password manager and generating passwords with a huge amount of entropy. I don't think this is entirely true, and so I often use TOTP with important sites. But I'm okay with storing the TOTP key in my password manager (which encrypts the password database with a long key phrase and a key file). Even on top of the very little chance that any of my long passwords are going to get leaked or broken, I think the chance that this happens because my password manager gets hacked along with the TOTP keys (as opposed to me getting phished or a vulnerability in a website) is pretty remote.