30 ms·

By that account, passwords are exactly the same, so it's not even 1.5FA but only 1FA with each being 0.5FA. Point of something being a second factor is for it

By that account, passwords are exactly the same, so it's not even 1.5FA but only 1FA with each being 0.5FA. Point of something being a second factor is for it to be something physically distinct from the first factor, and something different in the "something you know, something you are, something you have". As long as you keep your TOTP device and password manager separate, they provide all the guarantees a second factor should. As a bonus, they also provide one-time use tokens (both HOTP and TOTP, though HOTP is more susceptible to pre-generation of tokens to be used later), thus protecting against eavesdropping and people looking over your shoulder (or recording you). As such, I don't buy the argument for TOTP not being a second factor auth at all.

monocasa 5y ago
Passwords and TOTP are both something you know. And there are children comments here talking about how it's fine, they keep their TOTP keys in the same password database.
- necovek 5y ago
  They are both "something you know" only if you keep them on the same device. Yes, there are comments of people using them here that way. At my previous job, even a security IT guy did not find that an issue when I brought it up how people automated 2FA for CLI scripts. In that case, they are not even 1.5FA, they are strictly 1FA password-authentication (jumping through a few hoops to get all "components" of a password, but it's a single password protecting access). If they are separate devices and you don't really remember your key, they are hardly something you know, IMO, so I disagree there. In a sense, you could also extract the base cryptographic key of any hardware token (or the producer of the token might have it), and it's also "something you know", which is why I disagree. It's just trivial to extract this key for TOTP, but extraction is a separate step IMO.

monocasa 5y ago

Passwords and TOTP are both something you know. And there are children comments here talking about how it's fine, they keep their TOTP keys in the same password database.

necovek 5y ago
They are both "something you know" only if you keep them on the same device. Yes, there are comments of people using them here that way. At my previous job, even a security IT guy did not find that an issue when I brought it up how people automated 2FA for CLI scripts. In that case, they are not even 1.5FA, they are strictly 1FA password-authentication (jumping through a few hoops to get all "components" of a password, but it's a single password protecting access). If they are separate devices and you don't really remember your key, they are hardly something you know, IMO, so I disagree there. In a sense, you could also extract the base cryptographic key of any hardware token (or the producer of the token might have it), and it's also "something you know", which is why I disagree. It's just trivial to extract this key for TOTP, but extraction is a separate step IMO.