6 ms·

What kind of attack does it make possible that is impossible without TOTP in the password manager? I'm not considering online password managers which IMHO are

• m3nu 5y ago
  I keep TOTP separate on my phone. Password database will be decrypted in memory after it's unlocked and can be dumped with sufficient privileges. You could argue that an attacker with access to copy the password DB can intercept OTP as they are entered, but that seems much more work than running off with everything at once.
• joveian 5y ago
  It depends in part on the OS and how easy it is to go from any remote access to full password manager access. On most desktop systems it is very easy the next time the password manager is used, so a true second factor gives you more time to detect a remote breach of your account before getting locked out of all of your accounts. Everything you access between the breach and you discovering it could still be compromised (where compromised can mean the account is gone for good) so it is of limited use in practice but not necessarily useless considering the complexity of software that access the network (of course it can be nearly impossible to detect a breach but often isn't in practice). It would be much more effective at protecting access to accounts if there was a distinct account change TOTP vs. the regular one for login (or, say, one to make small purchases and a different one for larger money transfers), but I've never seen that. If you don't access financial accounts every day it can give you some time to detect the breach if you are lucky.