3 ms·
> Aaand we're down to single-factor authentication We're not, not really. The only single password that can unlock 2FA is that for the password manager, but mo
by dividedbyzero 5y ago
> Aaand we're down to single-factor authentication
We're not, not really. The only single password that can unlock 2FA is that for the password manager, but most phishing attacks I'm aware of target the specific services, not password managers, since it's usually way easier to fake a banking login. Good password managers will have dedicated apps, so entering that password on some janky website is not something victims will be used to, plus there should be something 2FA-ish as well (biometrics on an iPhone etc.), so that particular password should be considerably harder to get ahold of than most. That doesn't protect against a fully compromised device, but that's not something 2FA is very effective against anyway. I'd say it's good enough for now.
Perfect shouldn't be the enemy of the good; security is always a trade-off between less-than-perfect alternatives, and the obvious alternative for lots of people will be a .txt on their Desktop or in their Dropbox or even an email to themselves, or no 2FA at all. I've been told that no attacker would find one person's password list since they disguised it as an email draft, who'd think to look there? Putting backup codes in one's primay 1Password vault doesn't fare that badly against those.
> I do recommend a password manager, but not to keep would-be-two factors in one vault.
A separate vault means another password, where do you keep that? It'll be needed very infrequently, so it's easy to forget, especially under stress. Also, you'll want to make sure you have it when you're seven timezones away and just lost your phone, since vacation is prime phone-losing time and also a time when you might have to get at your emails really urgently, e.g. for travel documents; that's also a situation where printing out backup codes on paper might bite you if they stay behind at home. I'm not even sure how I'd set this up, afaik 1Password (Cloud) and LastPass don't support vault-level passwords.
This is a surprisingly little-discussed problem outside of corporate. And when it is discussed, many knowledgeable people view personal security through a corporate security lens, which isn't very practical, making this an IMO pretty underserved niche. I've discussed this with lots of people and I'm still not aware of any silver bullet solution, but the recommendation from TFA seems like a decent compromise for a sizable cohort, especially younger people who aren't comfortable with paper documents and/or are highly mobile.
- lbriner 5y ago> We're not, not really. We are, by definition down to single factor if you store the codes in the password vault. The argument wasn't that therefore the system is weak, it is just that the point of having a second/third factor is to add something that isn't already present in an attack against a system. One example would be that you leave your desk momentarily with your password vault unlocked and someone decides to quickly use your account to login to some system. Single point of failure. If you had the codes on a cellphone instead, firstly there is more of a chance that you would have taken your phone with you but even if you didn't, that "attack" now needs to access your phone as well. Not all attacks are strangers and not all are malicious, just somebody elevating their privileges via your status is an attack in the broadest sense, even if they did it for respectable reasons.
- dividedbyzero 5y ago> We are, by definition down to single factor if you store the codes in the password vault. Agreed, I should have worded that differently, that was just asking for someone to nitpick. But I don't think that detracts from my wider point. > One example would be that you leave your desk momentarily with your password vault unlocked and someone decides to quickly use your account to login to some system. TFA is talking about personal security, which I read as "private life security", not "workplace security for a software engineer on their work laptop in a semi-public space". That would be a much more high-value target with a very different threat landscape that warrants more effort to be spent on security (supported by security teams, on paid time, and having above-average security expertise).
- digitallyfree 5y agoI keep multiple password manager "vaults" (with Keepass) for multiple services. All of them have long passwords. Every morning, I will recall the passwords in my head to make sure I remember them, and on a schedule I'll log into the rarely used vaults just to ensure that access is working properly. The same goes for the passwords that I keep in memory as well (for email etc. where I may need to use a public computer in a emergency without my password manager or personal device available), bank PIN, important phone numbers, and so on. The idea is to recall the passwords so often (many times daily to start, then daily when it's stuck in your mind) so that you can do it in any circumstance while under stress. Of course this doesn't excuse the need for a secure backup of those crucial passwords somewhere, but at least the chance of forgetting them is next to none.
- remus 5y ago> Of course this doesn't excuse the need for a secure backup of those crucial passwords somewhere Sounds like you need a password manager manager!
- digitallyfree 5y agoYeah I use Keepass to store those as well.