3 ms·

Another one is when the user puts the password manager on the same phone that receives the 2nd factor by SMS or in an OTP app. Now all the data is available and

Another one is when the user puts the password manager on the same phone that receives the 2nd factor by SMS or in an OTP app. Now all the data is available and unlocked at the same time on the same device again. Or when the user puts the OTP 2nd factor in 1password. The best way to prevent that type of cheating is to enforce the user of physical keys like Yubikeys

acdha 7y ago
> Now all the data is available and unlocked at the same time on the same device again. This really depends on the device in question: if you're talking about an iPhone 3GS or later or an Android phone which is less than a couple years old, the device has pretty strict protections against cross-application access. It's still technically possible for a rooted device to compromise both but in practice that's not true for most users — call it 1.5-factor auth or something but it's a lot different than the classic desktop model where any running code has access to all of the data which you care about.
- leroy_masochist 7y ago
  If you have the latest iPhone/Mac, you can still get iMessages delivered to your desktop, easily facilitating a state in which (almost by default, given how eager Google is to remember your passwords) anyone who has access to your unlocked computer can log into your bank account just by visiting the bank's website and get immediate access to the 6-digit verification code that they text you. Sending codes within a native app that exists only and specifically on your handset is a much more robust solution; I'd imagine the reason why it's implemented so infrequently is that its upshot is a lot of angry, frantic calls to tech support.
  - acdha 7y ago
    > If you have the latest iPhone/Mac, you can still get iMessages delivered to your desktop … to your unlocked computer can log into your bank account just by visiting the bank's website and get immediate access to the 6-digit verification code that they text you. What you're thinking of is the Handoff feature which allows your desktop to get access to SMS, not iMessage, and that's been recommended against for exactly this reason for many years. It's also somewhat dwarfed by the fact that SMS is inherently insecure and not a responsible choice for MFA in any scenario. In the case of banks, they really need to be pushing FIDO since that protects against this threat and also the phishers who create very realistic sites including requests for SMS/TOTP codes.

acdha 7y ago

> Now all the data is available and unlocked at the same time on the same device again. This really depends on the device in question: if you're talking about an iPhone 3GS or later or an Android phone which is less than a couple years old, the device has pretty strict protections against cross-application access. It's still technically possible for a rooted device to compromise both but in practice that's not true for most users — call it 1.5-factor auth or something but it's a lot different than the classic desktop model where any running code has access to all of the data which you care about.

leroy_masochist 7y ago
If you have the latest iPhone/Mac, you can still get iMessages delivered to your desktop, easily facilitating a state in which (almost by default, given how eager Google is to remember your passwords) anyone who has access to your unlocked computer can log into your bank account just by visiting the bank's website and get immediate access to the 6-digit verification code that they text you. Sending codes within a native app that exists only and specifically on your handset is a much more robust solution; I'd imagine the reason why it's implemented so infrequently is that its upshot is a lot of angry, frantic calls to tech support.
- acdha 7y ago
  > If you have the latest iPhone/Mac, you can still get iMessages delivered to your desktop … to your unlocked computer can log into your bank account just by visiting the bank's website and get immediate access to the 6-digit verification code that they text you. What you're thinking of is the Handoff feature which allows your desktop to get access to SMS, not iMessage, and that's been recommended against for exactly this reason for many years. It's also somewhat dwarfed by the fact that SMS is inherently insecure and not a responsible choice for MFA in any scenario. In the case of banks, they really need to be pushing FIDO since that protects against this threat and also the phishers who create very realistic sites including requests for SMS/TOTP codes.