4 ms·

I outlined all the scenarios where the master password can be stolen. In none of the scenarios does a 2FA offer additional protection.

• sph 4y ago
  Yes it does, because 2FA means you need BOTH the master password and the second factor device to log in. Stealing the password is not enough. That is the point of 2FA.
  • oefrha 4y ago
    The point is in none of the scenarios 2FA isn’t compromised at the same time or is even needed (except in the offline cracking case, where cracking password + token is harder than cracking just password, but with a reasonable password both are practically impossible). Read again. Consider realistic attack vectors instead of repeating dogma.
    • fzeroracer 4y ago
      2FA, especially hardware based 2FA protects you from scenarios that could involve leaking of your passwords (such as many common MITM attacks, phishing, spoofing) and makes cracking a DB incredibly hard for your average hacker if they somehow get their hands on it. And you would have to define a 'reasonable password' because I could guarantee what you consider reasonable is orders of magnitude easier to crack than a 2FA + password solution. It objectively reduces the amount of attack vectors to gain access to your accounts. Calling it dogma when 2FA has known security advantages is just wrong.