3 ms·
Careful with those backups though. You should probably treat your TOTP secrets as password-equivalents. I grab all my QR codes or secrets, but I store them in
by bigiain 6y ago
Careful with those backups though. You should probably treat your TOTP secrets as password-equivalents.
I grab all my QR codes or secrets, but I store them in 1Password so they're strongly encrypted in my backups.
- saulrh 6y agoAgreed. They live in BitWarden right next to the passwords. I lose some security, since compromising my password manager now also compromises my 2FA, but the password manager is itself behind 2FA, a Yubikey, and its backup codes are on paper in my safe.
- justinc8687 6y agoYubikeys can do TOTP. Why not just store the secrets on the key itself?
- saulrh 6y agoLaziness, old Yubikey hardware that doesn't do TOTP natively, logging in to websites on my phone. I probably should upgrade, it's just pretty far down my to-do list.
- soupsranjan 6y agofor extra precaution, you might want to store TOTP secrets in a password manager thats separate from the one used to store passwords.
- cutemonster 6y agoAn attacker needs both the totp secret and the password, right? (Just so I'm not misunderstanding something.)
- saulrh 6y agoCorrect. So putting your TOTP codes in your password manager is no less safe than using the password manager in isolation, and likely substantially more safe, because it requires attackers to compromise your password manager in totality (which should be itself behind 2FA) rather than just phishing an individual password.
- cutemonster 6y agoThey sort of need remote code execution on my laptop, I'm thinking. Qubes OS maybe a good idea here -- isolated VMs. (One VM for the pwd manager)