13 ms·

Ask HN: Why do password managers have TOTP?

• Jaruzel 5y ago
  As a Brit of a certain age, I hate the term TOTP in this context, as it will always mean to me 'Top of The Pops'[1] ;) --- [1] https://en.wikipedia.org/wiki/Top_of_the_Pops https://en.wikipedia.org/wiki/Top_of_the_Pops
• Vladimof 5y ago
  I think that you are right, but I don't want 2FA, so I use the TOTP from my password manager. Also, I think that we should be able to reset a regular password with a TOTP? Why do we need email?
• tgsovlerkhgsel 5y ago
  Because some sites/companies force people who do not want MFA to use MFA, and people aren't willing to sacrifice convenience for security like that. (Probably also because some people really don't get the point of 2FA and demand that feature, but the above is enough of a legitimate reason to support it.)
• charcircuit 5y ago
  A password manager (database) is not something you know. It's something you have.
  • remus 5y ago
    The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these should be different things.
    • pjerem 5y ago
      If someone get access to my password manager, I’m screwed anyway. It contains far enough information to bypass any MFA of any service.
      • arubania2 5y ago
        Well isn’t that a problem in itself then? The way I understand it, the password database should only contain the passwords; then if someone got access to it (or your email app, same thing, as they would just do a password reset) 2FA would still protect you.
    • jeffp17 5y ago
      If someone gains access to your password manager, it is likely because you gave them access. If this was done under duress, there are bigger problems in the realm of physical security that are outside the scope of cybersecurity.
    • evanfarrar 5y ago
      I disagree that storing these separately is “the whole point of MFA”. Passwords can be hacked in a number of places, not just client side or in the password manager, so TOTP mitigates MITM style attacks where the password is known by an attacker but it was not gained from the password manager or the site. I certainly get that separating them would be theoretically better, but with TOTP in my password manager I end up using TOTP everywhere.
      • remus 5y ago
        Good point. I'd agree that totp on phone > totp in pw manager > no totp, so using it in some capacity is definitely better than not using it at all.
  • arubania2 5y ago
    I think that’s true as long as you never upload it to cloud, but keep it either on one device only or manually sync across more devices.
• encryptluks2 5y ago
  Because a password manager isn't the only way a password can get exposed, and having a secure way to save your TOTP secrets is not a bad idea either in case you lose your hardware key.
• pmontra 5y ago
  What kind of attack does it make possible that is impossible without TOTP in the password manager? I'm not considering online password managers which IMHO are inherently weaker than local ones. If somebody steals my laptop the passwords database is protected by a master password anyway.
  • m3nu 5y ago
    I keep TOTP separate on my phone. Password database will be decrypted in memory after it's unlocked and can be dumped with sufficient privileges. You could argue that an attacker with access to copy the password DB can intercept OTP as they are entered, but that seems much more work than running off with everything at once.
  • joveian 5y ago
    It depends in part on the OS and how easy it is to go from any remote access to full password manager access. On most desktop systems it is very easy the next time the password manager is used, so a true second factor gives you more time to detect a remote breach of your account before getting locked out of all of your accounts. Everything you access between the breach and you discovering it could still be compromised (where compromised can mean the account is gone for good) so it is of limited use in practice but not necessarily useless considering the complexity of software that access the network (of course it can be nearly impossible to detect a breach but often isn't in practice). It would be much more effective at protecting access to accounts if there was a distinct account change TOTP vs. the regular one for login (or, say, one to make small purchases and a different one for larger money transfers), but I've never seen that. If you don't access financial accounts every day it can give you some time to detect the breach if you are lucky.
• nerdawson 5y ago
  I think it’s a decent enough balance for most people. It’s still something you know plus something you have. If your credentials are somehow intercepted, you’re still covered. Presumably it only falls down in the event your machine is fully compromised at which point you have bigger things to worry about. With that said, it’s worth having separate 2FA setup on your actual password manager.
  • arubania2 5y ago
    > bigger things to worry about Do you mean things like seeing your photos? If your 2FA is not stored on the same machine then the attacker won’t be able to log into your bank / brokerage account, and that’s something I consider the main thing to worry about.
    • adgjlsfhk1 5y ago
      if a hacker is in your system enough to get totp keys, they can also just pay themselves from your bank account after you log in.
    • nerdawson 5y ago
      Important documents, source code, emails, ssh keys, you name it. If your machine is compromised, it’s game over. What’s to stop an attacker intercepting your 2FA codes by swapping out login pages for services you use? TOTP via PW manager is safer for most people than SMS based 2FA. Having your login codes on a separate device is better still but it’s a trade off with convenience. For some people that won’t be worthwhile but then it’s a question of threat model.
      • arubania2 5y ago
        > swapping out login pages Hmm you’re right, I didn’t think of the scenario when they would give you the machine back in a tampered state. I was gonna reply “well just wipe it once you get it back” but that assumes that I know it happened, so I’m still susceptible to the evil maid attack and such. Also fully agreed with the last paragraph.
• happyopossum 5y ago
  The whole thing you know. / thing you have is very outdated thinking. It made sense as a way to explain it 20+ years ago when 2fa was primarily done with physical RSA fobs, but it makes no sense in the modern world of TOTP, password managers, etc. For one thing, TOTP any it’s nature isn’t tied to a thing I have. Heck - you could build a TOTP token web service accessible from anywhere, it’s just an algorithm. Secondly, if you’re using a password manager, you likely don’t know the password, so that part doesn’t fit either. And if you insist on still fitting that square peg into todays round hole: The thing I know is my password managers’ decryption key, and the thing I have is my laptop / iPhone.
  • Falkon1313 5y ago
    Exactly. The thing I have is whatever device I'm using right now - could be my PC, my work laptop, my phone, or any other system I can plug a USB stick into. And the thing I know is - well I don't really know it at all - it's whatever whichever device I'm using spits out when I tell it to tell this other thing what I supposedly 'know'. And then the remote system, trying to be ultra-secure, says "ok we'll send you an email/message and you need to confirm that". But that third factor message comes in on the exact same device I'm using for both the first factor and the second factor. It's all just security theater. Conceptually, it kinda makes sense. Like when using a credit card, require the name on the card, expiration date, billing address, and CVC instead of just the number. But in practice, eh. We have nothing similar to the financial system to catch fraudulent ID usage. So it's all just extra annoyance. For practicality, almost everyone will end up with everything just being a single factor.
  • mike_d 5y ago
    The "modern world of TOTP" wasn't some advancement in thinking. It was cost. Doing 2FA correctly in isolated hardware is expensive. We traded adoption for an imperfect implementation.
  • timwis 5y ago
    Yes but you transmit the website password, so it’s possible for an attacker to gain access to that website through a data leak or through brute force, without gaining access to your password manager. Sure, they could do the same if they got hold of your TOTP secret, but that’s never transmitted (except at setup).
• rjzzleep 5y ago
  Where exactly are people supposed to store their recovery keys? I get that theoretically it’s supposed to be cold storage. Suppose you’re actually targeted by government, and you want to protect access you only have two possibilities. Store it in encrypted cold storage that people that are targeting you have access to or forget them altogether and lose access yourself. I feel like people have forgetting what is actually being protected from. Most MFA apps on iOS either store the keys in iCloud Keychain or some some third party sync service or not at all when your phone breaks. I think the threat model isn’t well thought through at all. An offline encrypted keystore doesn’t in fact have a worse security characteristic than most options listed above. And yes theoretically an hsm is better but realistically speaking I think a physical key that I carry around every day isn’t almighty either.
  • UncleMeat 5y ago
    If you are actually targeted by the government they'll pwn you with zero days on your browser or whatever. No authentication scheme will save you at that point. Real users should protect against credential stuffing and, if they can manage it, phishing.
  • Joeri 5y ago
    I think being targeted by government or a similar class of advanced threat is not something you should really think about when choosing how you manage passwords, as they will have many ways to target you that don’t involve password compromise at all. Password managers and MFA are about protecting from account compromise by run of the mill cybercriminals. Storing recovery keys on a piece of paper in a safe place is perfectly fine for that class of threats.
• deleted 5y ago
  [deleted]
• dub 5y ago
  One use case for password managers is account sharing among multiple people. Password managers make more money if they support that use case, which provides legitimate value in companies and families
• lysp 5y ago
  I agree. I use password manager for passwords. Use my phone for lower security TOTP codes, and a hardware key for things I was slightly more secure.
  • ghusto 5y ago
    You don't use your password manager on your phone? ;)
    • senectus1 5y ago
      under a different account that doesn't have the password to it stored in the password manager. yes. I also use a standalone 2FA for access to me password manager. Also, my work accounts are stored in a different password manager and THEY use 2 more different 2FA clients... its starting to get a bit much tbh
• stevebmark 5y ago
  Your laptop is a second factor device. You don’t need to reach for your phone to log into anything with 2FA. Use a program on your laptop so you can get a TOTP code with a keystroke.
• jeffp17 5y ago
  The assumption is that your password manager is only accessible on physical devices that you have authorized. The stored data is encrypted and will only decrypt upon being authenticated by whatever means you have setup (i.e. password, fingerprint, face id, etc.). The only way for a potential attacker to utilize an OTP generated by your password manager would be to somehow gain control of the physical devices where the password manager is installed and authenticate themselves as you. As I understand, preventing such a scenario is not the purpose of MFA. Rather, it is to prevent the scenario where an attacker either attempts to brute-force guess your password to a particular application (or figures it out in some other way) and now is blocked by the inability to get passed the "enter the OTP code from your authenticator app" question. --- The scenario that you ask about is a valid concern. It is just not the same concern as what is solved by OTP/MFA. One area where the notion of separation of keys makes more sense is cryptocurrency, where if you have any serious investment in it, it is advised to set up a multi-key scheme. In such a case, even if somebody were to be forcefully required to allow a physical attacker to gain access to their password manager, there would still not be enough information there for the attacker to steal anything.
  • 015a 5y ago
    Right; if an attack gains access to your password vault, then one vector MFA can protect against (the multi-factor part) isn't valid. But that's not the only vector. The biggest vector MFA protects against isn't really brute forcing (though it helps there); its password phishing. This is literally the only reason behind why Google's "account compromises dropped to zero after we required MFA internally" thing is a thing. Its easy to phish a password; but phishing MFA codes is a lot harder because, primarily, they're temporal. Phishing one is possible, but it would require the attacker to immediately use the code they phished, which significantly protects against broad phishing campaigns (as, automating a password phish + an MFA phish + logging in with that info within 30 seconds + navigating to the change password and remove MFA screen + phishing for a second and third MFA code to change the password and remove MFA is near-impossible). Spear-phishing can still be a threat vector, but its much rarer and also made more difficult.
    • deleted 5y ago
• pacifika 5y ago
  I agree otherwise all we’d need is a TOTP master password, and login to a service without password
• kitbrennan 5y ago
  I agree, it makes no sense to have them stored in the same password manager. One of the things I like about 1Password is that we were able to switch off the built in TOTP for our whole organisation, and force all TOTP codes to go via Duo Security. Thereby forcing a separate 2FA app.
  • cranekam 5y ago
    But both apps are on the same user devices, presumably? If so I can see that splitting them protects against the 1password DB being compromised but not against someone getting access to a user’s phone (which seems more likely to me).
• bigDinosaur 5y ago
  It's slightly less secure, in the sense that if someone gains access to your password database they'll have access to your MFA codes as well. The only scenario this would really matter in is if something like your phone or laptop was stolen, but not both, and they already could unlock your database file. Practically I'd say that using the TOTP functionality of your password manager is such a big win for the average user that I'd advise people use it without hesitation.
  • petepete 5y ago
    If you lock your password manager with a hardware security key, you get the best of both worlds. The NFC Yubikey works well in this niche.
• bingo-bongo 5y ago
  Depends on type of attack/level of security vs convenience. Having both username, password and TOTP in you password manager protects against password leaks from cloud services, but not from someone stealing/getting access to the content of your password manager. Having TOTP on separate device protects against both, but is also a bit more inconvenient in daily use.
• klaustopher 5y ago
  The team from 1password did a nice writeup, when they introduced storing TOTP in their password manager. Gist is: Most people treat TOTP as a second, time based password (multi step authentication) instead of a second factor. If you truly want 2nd factor, you should never sync your passwords to the phone you are using as 2FA, and never use your passwords on the phone you are using as 2FA. So it depends on your own security concerns if you want to treat TOTP as a true second factor or as a secondary, time based password only. https://blog.1password.com/totp-for-1password-users/ https://blog.1password.com/totp-for-1password-users/
  • tonyedgecombe 5y ago
    I've always assumed (possibly incorrectly) that my phone is more secure than my desktop.
    • circularfoyers 5y ago
      They are significantly more locked down and it's hardware more strictly controlled than most desktop OS's, so I would say that assumption is correct. It is looking as though desktop OS's will catch up in this regard considering the progress that's being made with immutable root filesystems and sandboxing with permission sets for user facing programs.
    • mrweasel 5y ago
      Personally I feel it’s a bit weird when people keep their TOTP on the phone they use to access the service that requires the token. If the idea was to keep things seperate, then either your phone shouldn’t when the tokens, or it shouldn’t be used to access secure services. Hardware token still feel like the safest option, but I also don’t what 8 different token generator in my pocket.
      • Symbiote 5y ago
        A hardware security key would allow you to have one thing in your pocket, used for many sites.
    • 5y ago
• andrecarini 5y ago
  Short answer: Password managers offer this funcionality because there is a demand for it. Long answer: In practice, TOTP schemes are used (from a webadmin point of view) just to stop credential stuffing attacks [1]. There is very little additional security in generating TOTPs on a dedicated device, such as a smartphone, compared to generating them on the password manager itself. Threat models in which a separate setup would have a benefit include only breaches of your password database itself. For savvy users with unique passwords, protecting against that threat model offers little benefit at a significant convenience penalty, as such attacks are unlikely to begin with. If MFA with hardware tokens is not an option, then it might not be worth the hassle of TOTPs. As such, password managers that offer TOTP are useful in scenarios where using TOTP is mandatory and does not provide security benefits. [1] https://en.m.wikipedia.org/wiki/Credential_stuffing https://en.m.wikipedia.org/wiki/Credential_stuffing
  • vladvasiliu 5y ago
    There's also the fact that it helps to somewhat mitigate phishing, in that they'll only offer to autofill the code if the website domain matches the one on file, like they do for the password.
  • andi999 5y ago
    I am not an expert, but "Threat models in which a separate setup would have a benefit include only breaches of your password database itself." doesnt this mean that there is a big difference if the attack vector is by a keylogger? (Which can sniff the Database pw). Are keyloggers not a common thing for threats (I dont know)?
    • manicdee 5y ago
      If the key logger is in a peripheral then the TOTP/password manager can still protect from replay attacks. If the key logger is on the computer then it has access to the password vault and the vault secret.
    • thinkharderdev 5y ago
      Not sure how common it is but if the endpoint is compromised to the point of having a keylogger installed then it's basically already game over.
• k8sToGo 5y ago
  If you are really strict about 2Fa, then in theory you would never be able to use your phone that you use for TOTP generation to login to Websites that use this TOTP Code either. So I'm pretty sure I already broke this separation due to convenience. So might as well put it in my PW Manager.
  • ttty 5y ago
    IPhone/android is much More secure than a browser extension or windows, even macos. Attack surface is much larger.
• bawolff 5y ago
  95% of the security of TOTP stuff is that users have no freedom in implementing it and thus cant mess it up. There is no equivalent of having "hunter2" as your password when the user doesn't choose the secret. They cant reuse secrets across sites if they dont choose secrets. Every other realistic threat is not helped by TOTP. There is some threats that in theory TOTP can help with, but dont given how it is used on the web. * phishing - just as easy to phish the token * trojan on your computer/shared workstation - just steal the session cookie or take control of browser remotely (For U2F/fido keys/webauth based 2fa the situation is a bit different, but almost nobody uses that)
  • heavenlyblue 5y ago
    But then users store these passwords on a sticky note attached to their display device…
    • UncleMeat 5y ago
      Which is pretty good against some real threats. Evil maids are very rare in comparison to credential stuffing.
    • bawolff 5y ago
      Its debatable how bad that is. For most (not all) people, the realistic threats do not have physical access to your computer. However, this is kind of my point - you might put your password on a sticky not. In TOTP 2FA the equivalent is your qr code. I have never seen anyone print out a qr code and put it on a sticky note beside their computer.
• rand49an 5y ago
  I work for an MSP who uses the MFA function of a password manager to access customer accounts, this means 2FA codes can be shared across teams of people and offers significant protection against credentials being stolen as they can't be used once access is revoked to the password manager. We turn off exporting the MFA codes so that also can't be stolen.
• austhrow743 5y ago
  Different people have different goals. Just because a buyer for an organisation or a provider of a service wants users to use TFA doesn’t mean the users want to deal with it. This is sort of like asking why do defence attorneys defend their client of the prosecution wants to convict them or why stores have security cameras if I want to take their stuff for free.
• hsbauauvhabzb 5y ago
  Side question: why is nobody losing their minds over the fact that almost all other MFA actions rely on your phone, which almost always has access to critical services (banking, work mail, personal mail, possibly ssh, etc). I’m more concerned about losing my Device as many MFA tokens are not backed up in apple ecosystem. The architecture is flawed for conveniences sake.
  • k8sToGo 5y ago
    Use something like Authy. It supports Backup. Anyways, you are supposed to stash your recovery codes somewhere (not on the phone).
  • kevin_thibedeau 5y ago
    This is really annoying with employers who assume they can use your personal phone as part of their MFA fig leaf.
    • kevincox 5y ago
      Especially when it isn't plain TOTP but some custom app.
    • hsbauauvhabzb 5y ago
      Given the preference I’d rather not carry around an additional phone or hw token. But I fully understand those who don’t appreciate it. You can possibly force bespoke token apps into google Authenticator or the ms variant if they use standard Totp or hotp (ms auth on AAD does not by default but you can force it to provide one during the workflow).
  • marc_abonce 5y ago
    This is such a big frustration I have with phone based 2fa. It's obvious that the people that push for this are from the first world and have never been mugged or even worried about it.
• Aulig 5y ago
  I personally have a second password database that generates my MFA codes. I only open that on my phone (because I think the KeePass desktop app doesn't support TOTP out of the box). I guess in this case it's like a second password. Only really useful if someone only manages to bruteforce/spy my main master key but not the second one, right? Would love to hear opinions on this, I might be missing something.
  • k8sToGo 5y ago
    KeepassXC supports TOTP
  • lnl 5y ago
    KeePass supports TOTP out of the box without any plugins since the 2.47 release in January 2021: https://keepass.info/news/n210109_2.47.html https://keepass.info/news/n210109_2.47.html Usage: https://keepass.info/help/base/placeholders.html#otp https://keepass.info/help/base/placeholders.html#otp
    • Aulig 5y ago
      Oh that's nice, thank you!
• SahAssar 5y ago
  I keep TOTP in my password manager, but my password manager is encrypted with a hardware key, a PIN code, and even getting the encrypted files depends on getting into my private git server. I also only use TOTP on sites that don't support u2f/fido/webauthn or implement it badly (like amazon that only allows a single key).
  • k8sToGo 5y ago
    What happens if you lose the hardware key? Is there a recovery mechanism?
    • pebble 5y ago
      Standard practice is to have two if one breaks or is lost.
    • SahAssar 5y ago
      I have multiple, both for that scenario and for different computers. I also have a USB stick with the root key for issuing new keys if all my hardware keys break.
  • daenz 5y ago
    You can actually use multiple security keys on AWS I found out. It requires you to use the yubico authenticator app though. Essentially your security key stores the MFA secrets on it, and the yubico authenticator app accesses them for TOTP. You can register multiple keys in the authenticator app. So even though you can only have one MFA virtual device in AWS, that one virtual device is backed by multiple keys.
    • SahAssar 5y ago
      Then you don't get the strong phising protection though. One of the reasons U2F/webauthn is great at phising protection is that the key verifies the sites domain. IIRC there has only been one good attack against that and even that required the user to allow webUSB for the phising site (and it has been patched).
• timwis 5y ago
  I asked this question on the 1Password forum 3 years ago, and thought the responses were interesting: https://1password.community/discussion/101714/why-is-it-a-good-idea-to-store-2fa-tokens-in-1password https://1password.community/discussion/101714/why-is-it-a-go...
• deleted 5y ago
  [deleted]
• troad 5y ago
  Considering I don't know my passwords, nor can I generate TOTP codes off the top of my head, both are "things I have" for me (a password manager + TOTP manager). And because of this, I prefer to keep the two things separate. That way you need to compromise two services rather than just one. Realistically though, once an attacker's gained access to your computer or phone, there's very little you can do to prevent them misusing that data. You can keep your TOTP on a second device encrypted with a Yubikey that you keep in a vault in Geneva, but it's not overly useful when an attacker can simply call your bank and read out the security reset SMS they sent you/him. I'm happy to hear from security power users if there's anything I'm missing.
• neximo64 5y ago
  Because users want it. Quite simple. What users want > What is good practice.
• themehdi 5y ago
  We use it on shared accounts (sometimes they are inevitable) Before this feature, we had to rely on backup codes.
• DyslexicAtheist 5y ago
  It usually doesn't except when your threat model includes a scenario where physical compartmentalization is supposed to prevent giving up the secret under duress (you don't carry the out of band device with you to wherever you go). But in that case you're better off being able to plausibly deny the existence of that secret (or the communication channel) in the first place.
• nicoburns 5y ago
  Worth noting that a lot of services now force MFA even if the user doesn’t consider it important enough to warrant it (MFA is always a trade off between security on one side, and convenience and the risk of losing access entirely on the other hand) Putting a TOTP code in a password manager is in many was a way of turning off MFA for services that don’t let you do this.
• hu3 5y ago
  TOTP = Time-based One Time Password. MFA = Multi Factor Authentication. For those who didn't know, like me. I wish acronyms were less used or at least described when introduced. Like Elon Musk once said: "Don't use acronyms or nonsense words for objects, software or processes at Tesla. In general, anything that requires an explanation inhibits communication. We don't want people to have to memorize a glossary just to function at Tesla."
  • karaterobot 5y ago
    Ha, I went and researched this too, thinking I'd post the same basic comment. Should have read a little further. In general, I think it's good practice to do like the newspapers and define an abbreviation on first usage (which in this case would be the original post).
• anhncommenter25 5y ago
  For me I weighed the risks and decided that losing my phone and getting locked out of services with 2FA was a more realistic problem than someone compromising my password manager. I still use 2FA when it's available because it still protects against an individual password leak.
• remram 5y ago
  If it was on a different app on the same device, it still wouldn't be the 2FA you're talking about.
• bombcar 5y ago
  Because nobody, not even fancy techies, really cares about security, they care about "good enough" and all the usability they can get.
• Jamie9912 5y ago
  What's TOTP?
• buddylw 5y ago
  I really like having totp functionality. I use a yubikey for TOTP and boot into an air gapped machine with keypass to store the TOTP codes in case I lose or break the yubikey. I don’t store TOTP codes in my main password manager, but it’s not completely insane. You’re screwed if someone gets your decrypted password database, but you’re still protected from most other attack vectors.
• Tagbert 5y ago
  Could you unpack the TOTP Acronym, please? I’m sure that it means something to you but it is not obvious nor as widespread as you may think.
  • wjdp 5y ago
    Time based One Time Password. The app or password manager stores a secret, which when combined with the current time yields a OTP. https://en.wikipedia.org/wiki/Time-based_one-time_password https://en.wikipedia.org/wiki/Time-based_one-time_password
• xs83 5y ago
  TOTP and MFA are 2 different things even though they are often used together. MFA is all about having a second physically held device to authenticate, TOTP is one of the mechanisms by which this is done. Not everything needs MFA, however it is often mandated so having the ability to generate TOTP in a situation like this (such as when an account is shared and pure security is not crucial) is convenient.