3 ms·
Isn't the whole point of 2FA to keep you safe if your passwords get compromised? Seems like you may as well not bother with it. I guess this means that any att
by AndrewOMartin 5y ago
Isn't the whole point of 2FA to keep you safe if your passwords get compromised? Seems like you may as well not bother with it.
I guess this means that any attacker will need to compromise your keepass database rather than just one of your other passwords, but it would help avoid a potential "hosed" scenario.
Maybe you think you're more likely to lose your phone then leak your master password? Perfectly reasonable I suppose :)
- willis936 5y agoPasswords are sending secrets around. TOTP auth doesn't involve sending any secrets because the algorithm shouldn't be practically reversible. My master password has hundreds of bits of entropy and only leaves my brain to enter it. Most likely bad scenario is master password gets lifted from a keylogger and the database is stolen. I don't see what keeping the secrets in an app does to help that though.
- rasse 5y agoSounds about correct, but this setup provides adequate protection against phishing and MITM attacks. The KeePass database itself can be hardened with a 2FA token.