5 ms·

Isn't "integrated 2fa" defeating the purpose, though? I find the 2fa should be separate, even on a separate device, from the password store. Which is why I ne

by berkes 6y ago

Isn't "integrated 2fa" defeating the purpose, though? I find the 2fa should be separate, even on a separate device, from the password store. Which is why I never use this OTP/2FA feature in my favorite passwordmanager Bitwarden.

delfinom 6y ago
Logically, yes, reality if you think deeply, it's no different than having a OTP app on your phone and also the password manager.... At best if you are so concerned you just create a second keepass DB for OTP or if you are more concerned, have two phones ;) I can't take software like bitwarden seriously because they still require you to have a cloud account and/or run your own server which I also have no interest in. I want something I can actually backup natively on a client without extra effort like a script running agaisnt an api. A single file encrypted database is more than adequate. Control and ownership of the password blob is just so absolutely critical if you invest heavily in password management, especially with sites that take a stance of "password/otp or we'll never recover the account"
yjftsjthsd-h 6y ago
The advantage to OTP, even when stored with the password, is that it switches from shared-secret to asymmetric-key login. Of course in theory with a good hash+salt it's nearly the same, but with OTP I have better confidence that an attacker can't steal my credentials. (I mean, I say this as someone who also keeps 2FA separate, but I do see some benefit to 2FA even stored with the password)
- techslave 6y ago
  eh? what OTP scheme is asymmetric?
selykg 6y ago
When using a password manager of sufficient security the weakness isn't the password manager. The password manager is likely the strongest security app that most people use on the daily. If you store both the password and 2FA in something that secure, is it really causing any real harm? If your threat model dictates that this IS a threat for you, then by all means, don't do that. But I think for the average person this is far more secure than some of the alternatives they'd be doing otherwise.
7786655 6y ago
In addition to what other people have said, some sites force you to use 2FA or endlessly bug you to enable it.
- adrianmonk 6y ago
  Along those same lines, I also store my security questions/answers in my password manager. In many cases, the security questions are stupid, but if I'm forced to do it, then at least I can keep it organized.
  - pintxo 6y ago
    I usually just generate long >32 chars random strings as answers to these stupid questions, and store the string in my password manager as well. Worked great, until some support person on the phone actually wanted to know the answer...

by berkes 6y ago

delfinom 6y ago

Logically, yes, reality if you think deeply, it's no different than having a OTP app on your phone and also the password manager.... At best if you are so concerned you just create a second keepass DB for OTP or if you are more concerned, have two phones ;) I can't take software like bitwarden seriously because they still require you to have a cloud account and/or run your own server which I also have no interest in. I want something I can actually backup natively on a client without extra effort like a script running agaisnt an api. A single file encrypted database is more than adequate. Control and ownership of the password blob is just so absolutely critical if you invest heavily in password management, especially with sites that take a stance of "password/otp or we'll never recover the account"

yjftsjthsd-h 6y ago

The advantage to OTP, even when stored with the password, is that it switches from shared-secret to asymmetric-key login. Of course in theory with a good hash+salt it's nearly the same, but with OTP I have better confidence that an attacker can't steal my credentials. (I mean, I say this as someone who also keeps 2FA separate, but I do see some benefit to 2FA even stored with the password)

techslave 6y ago
eh? what OTP scheme is asymmetric?

selykg 6y ago

When using a password manager of sufficient security the weakness isn't the password manager. The password manager is likely the strongest security app that most people use on the daily. If you store both the password and 2FA in something that secure, is it really causing any real harm? If your threat model dictates that this IS a threat for you, then by all means, don't do that. But I think for the average person this is far more secure than some of the alternatives they'd be doing otherwise.

7786655 6y ago

In addition to what other people have said, some sites force you to use 2FA or endlessly bug you to enable it.

adrianmonk 6y ago
Along those same lines, I also store my security questions/answers in my password manager. In many cases, the security questions are stupid, but if I'm forced to do it, then at least I can keep it organized.
- pintxo 6y ago
  I usually just generate long >32 chars random strings as answers to these stupid questions, and store the string in my password manager as well. Worked great, until some support person on the phone actually wanted to know the answer...