5 ms·

"Honestly I'm excited that we are getting 2FA pretty mainstream" Doesn't that have those extra steps included as well that you critizised on email-based auth?

scim-knox-twox 5y ago
No, password managers can take care of that.
- umeshunni 5y ago
  Can password managers deliver OTPs or other 2FAs?
  - unilynx 5y ago
    1Password can do TOTP
    - skyeto 5y ago
      Though it defeats the point of TOTP to some extent.
      - jackweirdy 5y ago
        It still proves you’re giving the password right this moment, and that it hasn’t been popped from a DB. On the other hand it doesn’t prove that someone has stolen your phone/laptop, defeated all of its own security, and then defeated the security of the password manager. For my personal risk propensity, the former is worth having, the latter is too unlikely to worry about
      - scim-knox-twox 5y ago
        No, it just depends on your case.
      - forty 5y ago
        (I work for a company that makes a password manager that have this feature too) I used to think that but I changed my mind. First, you can set TOTP (or other second factors) authentication on your password manager account, which I think is good philosophically at least, because you gotta have access to your second factor to get access to you website TOTP. Secondly, using a password manager with strong unique passwords that you don't know brings already a lot of benefits that pushes websites and administrator to push using a second factor (it's very often a way to avoid attacks using reused or bad passwords). You do lose a bit of security (there is now a risk that your TOTP seed get stollen), but the extra convenience (especially when you lose your TOTP device) means you can enable it on more websites without too much annoyances.
- slapslash 5y ago
  Wait, are we talking about the same 2FA? I meant logging in with password and then 2FA with something like Google Authenticator from another device (mobile phone). If the password manager would do both of it, where would be the extra security?
  - duijf 5y ago
    Form a corporate perspective: 2FA would still force a unique secret per user. That can be useful when your users tend to reuse passwords for different sites or choose poor ones. I have seen folks use password managers to store their poor non-autogenerated passwords. For users that do use the PW manager properly, having the PW manager store the TOTP secrets is indeed "putting all of your eggs in one basket".

scim-knox-twox 5y ago

No, password managers can take care of that.

umeshunni 5y ago
Can password managers deliver OTPs or other 2FAs?
- unilynx 5y ago
  1Password can do TOTP
  - skyeto 5y ago
    Though it defeats the point of TOTP to some extent.
    - jackweirdy 5y ago
      It still proves you’re giving the password right this moment, and that it hasn’t been popped from a DB. On the other hand it doesn’t prove that someone has stolen your phone/laptop, defeated all of its own security, and then defeated the security of the password manager. For my personal risk propensity, the former is worth having, the latter is too unlikely to worry about
    - scim-knox-twox 5y ago
      No, it just depends on your case.
    - forty 5y ago
      (I work for a company that makes a password manager that have this feature too) I used to think that but I changed my mind. First, you can set TOTP (or other second factors) authentication on your password manager account, which I think is good philosophically at least, because you gotta have access to your second factor to get access to you website TOTP. Secondly, using a password manager with strong unique passwords that you don't know brings already a lot of benefits that pushes websites and administrator to push using a second factor (it's very often a way to avoid attacks using reused or bad passwords). You do lose a bit of security (there is now a risk that your TOTP seed get stollen), but the extra convenience (especially when you lose your TOTP device) means you can enable it on more websites without too much annoyances.
slapslash 5y ago
Wait, are we talking about the same 2FA? I meant logging in with password and then 2FA with something like Google Authenticator from another device (mobile phone). If the password manager would do both of it, where would be the extra security?
- duijf 5y ago
  Form a corporate perspective: 2FA would still force a unique secret per user. That can be useful when your users tend to reuse passwords for different sites or choose poor ones. I have seen folks use password managers to store their poor non-autogenerated passwords. For users that do use the PW manager properly, having the PW manager store the TOTP secrets is indeed "putting all of your eggs in one basket".