3 ms·
An attacker needs both the totp secret and the password, right? (Just so I'm not misunderstanding something.)
by cutemonster 6y ago
An attacker needs both the totp secret and the password, right?
(Just so I'm not misunderstanding something.)
- saulrh 6y agoCorrect. So putting your TOTP codes in your password manager is no less safe than using the password manager in isolation, and likely substantially more safe, because it requires attackers to compromise your password manager in totality (which should be itself behind 2FA) rather than just phishing an individual password.
- cutemonster 6y agoThey sort of need remote code execution on my laptop, I'm thinking. Qubes OS maybe a good idea here -- isolated VMs. (One VM for the pwd manager)