4 ms·
I store both passwords and 2FA in an automated software. 2FA seeds can be exported (eg. when moving to a new phone). the categorization makes some minimal sens
by pas 4y ago
I store both passwords and 2FA in an automated software. 2FA seeds can be exported (eg. when moving to a new phone).
the categorization makes some minimal sense, but basically any additional not-identical "factor" is additional security (though there's obviously a diminishing return because of the complexity-vs-security trade off).
- tzmudzin 4y ago> I store both passwords and 2FA in an automated software. This effectively reduces the 2nd factor to the first, and indeed produces the diminishing return. It's sufficient to hack one system using one method and you compromise both defenses. The point behind 2nd factor is to provide a second, *independent* layer of protection that would need to be compromised using an entirely different attack. In the case of the FIDO2 dongles including the Yubikeys the secret isn't even stored on your system, but on the device itself that doesn't even disclose it to your connected system.
- pas 4y agoUm, excuse my shoddy phrasing. I meant a desktop password manager and a mobile TOTP manager. Both are software, but they are not "a software", sorry. But yes, recently I have seen people use password managers that really do both in one single piece of software (a browser extension). I have a few U2F hardware devices, they are convenient when set up and plugged in, rather inconvenient otherwise :/