4 ms·
I'm a little confused here, but I thought 2fa was a combination of something I know (A password) and something I have (A authenticator). So a attacker getting a
by Anunayj 4y ago
I'm a little confused here, but I thought 2fa was a combination of something I know (A password) and something I have (A authenticator). So a attacker getting access to your computer is same as them getting access to your authenticator?
Or do you mean that this leaves the secrets vulnerable to spyware and stuff? Cause in that case as the other comment says, one could use the TPM.
- vertis 4y agoA good example here is 1Password, which stores passwords and also allows storing TOTP. Which means the something I know is stored in the same places as something I have. Granted it is protected by encryption, and another password, but it definitely increases the attack surface. If the computer is compromised it becomes much more possible to get access to both of these items than if it was a security key, physical authenticator or even on a different device.