4 ms·

To leak my master password, “any other idiot on the internet” needs to do one of four things: (1) backdoor my password manager; (2) install a keylogger to captu

by oefrha 4y ago

To leak my master password, “any other idiot on the internet” needs to do one of four things: (1) backdoor my password manager; (2) install a keylogger to capture it while I’m typing it in; (3) somehow grab a copy of the encrypted database and crack it offline; (4) read my mind. (1) is game over; (2) with that level of access they can also steal everything while the password manager is unlocked; (3) with offline cracking, any 2FA protection just extends the password, and my master password is strong enough for any idiot on the Internet; (4) can’t defend against magic.

sph 4y ago
Sorry, I'm not sure I follow. First you say that 2FA is useless if someone gets your master password, which is wrong, now you argue that stealing a master password is very hard. What exactly is your point?
- oefrha 4y ago
  I outlined all the scenarios where the master password can be stolen. In none of the scenarios does a 2FA offer additional protection.
  - sph 4y ago
    Yes it does, because 2FA means you need BOTH the master password and the second factor device to log in. Stealing the password is not enough. That is the point of 2FA.
    - oefrha 4y ago
      The point is in none of the scenarios 2FA isn’t compromised at the same time or is even needed (except in the offline cracking case, where cracking password + token is harder than cracking just password, but with a reasonable password both are practically impossible). Read again. Consider realistic attack vectors instead of repeating dogma.
      - fzeroracer 4y ago
        2FA, especially hardware based 2FA protects you from scenarios that could involve leaking of your passwords (such as many common MITM attacks, phishing, spoofing) and makes cracking a DB incredibly hard for your average hacker if they somehow get their hands on it. And you would have to define a 'reasonable password' because I could guarantee what you consider reasonable is orders of magnitude easier to crack than a 2FA + password solution. It objectively reduces the amount of attack vectors to gain access to your accounts. Calling it dogma when 2FA has known security advantages is just wrong.

by oefrha 4y ago

sph 4y ago

Sorry, I'm not sure I follow. First you say that 2FA is useless if someone gets your master password, which is wrong, now you argue that stealing a master password is very hard. What exactly is your point?

oefrha 4y ago
I outlined all the scenarios where the master password can be stolen. In none of the scenarios does a 2FA offer additional protection.
- sph 4y ago
  Yes it does, because 2FA means you need BOTH the master password and the second factor device to log in. Stealing the password is not enough. That is the point of 2FA.
  - oefrha 4y ago
    The point is in none of the scenarios 2FA isn’t compromised at the same time or is even needed (except in the offline cracking case, where cracking password + token is harder than cracking just password, but with a reasonable password both are practically impossible). Read again. Consider realistic attack vectors instead of repeating dogma.
    - fzeroracer 4y ago
      2FA, especially hardware based 2FA protects you from scenarios that could involve leaking of your passwords (such as many common MITM attacks, phishing, spoofing) and makes cracking a DB incredibly hard for your average hacker if they somehow get their hands on it. And you would have to define a 'reasonable password' because I could guarantee what you consider reasonable is orders of magnitude easier to crack than a 2FA + password solution. It objectively reduces the amount of attack vectors to gain access to your accounts. Calling it dogma when 2FA has known security advantages is just wrong.