4 ms·
password managers let you store the one time password key. this removes the "two factor" nature of two factor, but retains the one time password nature of one
by vmception 6y ago
password managers let you store the one time password key.
this removes the "two factor" nature of two factor, but retains the one time password nature of one time password.
I honestly can't relate to people losing their access because something happened to their phone. The QR code is just a string of letters and numbers and you can save the QR code and the string of letters and numbers. I've been doing this for like a decade.
- katsura 6y agoDo they have the that though? When I turned the 2FA on it was only SMS option, so if your phone number is lost you are out of luck.
- vmception 6y agoI don't know about paypal.
- resoluteteeth 6y agoI thought they had added support normal TOTP now but if not you can probably still use the old method of generating a Symantec VIP style ID which has allowed you to use any TOTP app with paypal for years.
- Tsiklon 6y agoPayPal 2FA via OTP has apparently been available for at least 6 months
- dingaling 6y agoIt had, but when they forced me through the 2FA enrolment flow recently the only option was SMS. To use OTP I had to break out of that flow and start from a different part of the site.
- gregoriol 6y agoStoring the second factor in the same password manager as the password is a lot like having a post-it with the password on your desk: it's practical, but defeats the purpose. But to add to this, I wouldn't ever set up a 2FA on a service that doesn't allow multiple second factors, and mostly static backup codes. Having only one (ie. device) is a much higher risk, of being locked out, than having the password stolen.
- vmception 6y agoIf your password manager is compromised you are screwed. When looking at the actual attack vectors though it is vastly improved: Mitigated - Online attacks on your account at any service Mitigated - In person attacks on your account due to post-it notes Mitigated - Losing your phone which was the only way you could generate a one time password All this drama is mitigated, turning a disaster into a 5 second recovery.
- TT3351 6y agoAt least I know whoever is using my password is siting at my desk looking at the post-it (provided of course they didn't photograph it). Point being: it doesn't entirely defeat the purpose, in a similar way to how TSA locks don't defeat thieves, but delay them/lead them to find a different target.
- justinclift 6y agoJust to point out... mobile phone's aren't 100% universal, though a lot of places pretend they are. Up until about 18 months ago I used to live in a part of the UK without any mobile phone coverage. So, any mobile number I had (with Vodafone) always expired after 3 months. That does not make for any kind of fondness of places trying to blindly force SMS based 2FA on everyone. ;)