13 ms·
The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these
by remus 5y ago
The issue is that if someone gains access to your password manager then they have both your password and your totp secret. The whole point of MFA is that these should be different things.
- pjerem 5y agoIf someone get access to my password manager, I’m screwed anyway. It contains far enough information to bypass any MFA of any service.
- arubania2 5y agoWell isn’t that a problem in itself then? The way I understand it, the password database should only contain the passwords; then if someone got access to it (or your email app, same thing, as they would just do a password reset) 2FA would still protect you.
- jeffp17 5y agoIf someone gains access to your password manager, it is likely because you gave them access. If this was done under duress, there are bigger problems in the realm of physical security that are outside the scope of cybersecurity.
- evanfarrar 5y agoI disagree that storing these separately is “the whole point of MFA”. Passwords can be hacked in a number of places, not just client side or in the password manager, so TOTP mitigates MITM style attacks where the password is known by an attacker but it was not gained from the password manager or the site. I certainly get that separating them would be theoretically better, but with TOTP in my password manager I end up using TOTP everywhere.
- remus 5y agoGood point. I'd agree that totp on phone > totp in pw manager > no totp, so using it in some capacity is definitely better than not using it at all.