4 ms·
A typical password manager is two factors: something you have (the password database) and something you know (the master password).
by mr_mitm 5y ago
A typical password manager is two factors: something you have (the password database) and something you know (the master password).
- robjan 5y agoA typical password manager is BitWarden or LastPass which is on the cloud and only requires your master password.
- koprulusector 5y agoMy LastPass requires master password + yubikey
- mr_mitm 5y agoIf cloud-based password managers are set up without using a keyfile or something similar, then I agree, they're single factor. I suggest refraining from using such password managers for this reason.
- dividedbyzero 5y agoYou can set up LastPass and 1Password Cloud with second factors like USB security keys
- pid-1 5y agoThats just no true, most pw managers allow setting up MFA.
- rinze 5y agoPrecisely because of that I use a different solution: Dropbox + KeePassXC. If someone wants to access my passwords, they first have to get into my Dropbox account, then get the password to the KeePass file. At this point that level of security is good enough for me. Edit: typos.
- Aachen 5y agoBy that logic the password itself is two-factor, because you need the database password as well as the database file to obtain the target password. I definitely see where you're coming from, but I'm not sure why you'd still bother setting up 2FA with backup codes then if you already consider the password itself 2FA? A higher security level, which isn't needed for everyone indeed, would be to have these two things (where you have your password database unlocked, usually multiple times a day, and the second factor secret codes) in independent locations. This can also be two VMs if you keep the host encrypted and very secure for example. I assumed people with 2FA wanted to achieve a bit higher security level than all eggs in one basket. (None of these things beat a wrench attack of course.)