3 ms·
The irony is of course that you're now back to a single factor if you store your TOTP secrets in your password manager. But a good single factor is probably fi
by nisegami 4y ago
The irony is of course that you're now back to a single factor if you store your TOTP secrets in your password manager.
But a good single factor is probably fine.
- giaour 4y agoIt's only a single factor if your password manager login is compromised. If you're instead the victim of a phishing attack or you somehow spill the password + an MFA token for a single service, then you still get some of the protections you would expect from MFA (e.g., the leaked login will be time-boxed and non-renewable).
- worble 4y agoTo be honest, the most likely surface of attack for a user are database leaks. So long as your password manager is uncompromised, even if someone does manage to get ahold of your username/password for a specific site they won't get anywhere.