2 ms·
Passwords and TOTP are both something you know. And there are children comments here talking about how it's fine, they keep their TOTP keys in the same passwor
by monocasa 5y ago
Passwords and TOTP are both something you know.
And there are children comments here talking about how it's fine, they keep their TOTP keys in the same password database.
- necovek 5y agoThey are both "something you know" only if you keep them on the same device. Yes, there are comments of people using them here that way. At my previous job, even a security IT guy did not find that an issue when I brought it up how people automated 2FA for CLI scripts. In that case, they are not even 1.5FA, they are strictly 1FA password-authentication (jumping through a few hoops to get all "components" of a password, but it's a single password protecting access). If they are separate devices and you don't really remember your key, they are hardly something you know, IMO, so I disagree there. In a sense, you could also extract the base cryptographic key of any hardware token (or the producer of the token might have it), and it's also "something you know", which is why I disagree. It's just trivial to extract this key for TOTP, but extraction is a separate step IMO.