4 ms·

This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The on

This is super cool but do folks really need their google and GitHub 2FA codes often enough to justify this? Browser sessions are pretty durable it seems. The one thing I could think of is GitHub admin type actions that prompt for a credential to enter “sudo” mode or whatever they call it. However in that case they’ll take your password as well (or a webauthn key in my case)

edent 4y ago
I use systems which require a 2FA code every day, or whenever a destructive action takes place. So this is certainly useful for some people.
m-p-3 4y ago
It saved me a trip back to my desk a few times when I had to sign in to an account protected by 2FA on another computer and I forgot to bring my phone along.
teaearlgraycold 4y ago
I have everything in 1P. No need for a physical device.
- MartinCron 4y ago
  I always thought that the benefit of the physical device was that it was decoupled from the main device. If someone steals my laptop, for example, they won't be able to access my MFA secured accounts unless they ALSO steal my phone (and are unable to lock it).
  - cyphar 4y ago
    Sure, but if your threat model is that the attacker has enough access to your machine to extract your password manager's database, they can also just copy your session cookies from your existing browser session. Even in the case of password leaks, if someone breaches the password database of a website they can just as easily dump the TOTP table. Personally my view is that (if you're using a password manager with a unique password per-site) 2FA primarily protects you when you have to input your password on an untrusted system that may have a keylogger. In that case it doesn't really matter where you store the TOTP key (presumably you're not going to unlock your password database on that machine). To be fair, in the case of a security bug in the password manager (such as the few previous LastPass bugs in this vein), you are slightly more protected. But I use KeePassXC which has a far more segregated design so I'm not as worried about this as I would be if I was using a password manager entirely integrated into the browser (either built-in or an extension). (Though these days I primarily use U2F/WebAuthn if the site supports it.)
bdcravens 4y ago
Some sites prompt more frequently (for example, AWS)
SoftTalker 4y ago
Some folks don't use browser sessions. I log out of everything every day.
abawany 4y ago
Also, some sites, such as Fidelity, now require the 2fa password on every login regardless of browser trust status.

edent 4y ago

I use systems which require a 2FA code every day, or whenever a destructive action takes place. So this is certainly useful for some people.

m-p-3 4y ago

It saved me a trip back to my desk a few times when I had to sign in to an account protected by 2FA on another computer and I forgot to bring my phone along.

teaearlgraycold 4y ago

I have everything in 1P. No need for a physical device.

MartinCron 4y ago
I always thought that the benefit of the physical device was that it was decoupled from the main device. If someone steals my laptop, for example, they won't be able to access my MFA secured accounts unless they ALSO steal my phone (and are unable to lock it).
- cyphar 4y ago
  Sure, but if your threat model is that the attacker has enough access to your machine to extract your password manager's database, they can also just copy your session cookies from your existing browser session. Even in the case of password leaks, if someone breaches the password database of a website they can just as easily dump the TOTP table. Personally my view is that (if you're using a password manager with a unique password per-site) 2FA primarily protects you when you have to input your password on an untrusted system that may have a keylogger. In that case it doesn't really matter where you store the TOTP key (presumably you're not going to unlock your password database on that machine). To be fair, in the case of a security bug in the password manager (such as the few previous LastPass bugs in this vein), you are slightly more protected. But I use KeePassXC which has a far more segregated design so I'm not as worried about this as I would be if I was using a password manager entirely integrated into the browser (either built-in or an extension). (Though these days I primarily use U2F/WebAuthn if the site supports it.)

bdcravens 4y ago

Some sites prompt more frequently (for example, AWS)

SoftTalker 4y ago

Some folks don't use browser sessions. I log out of everything every day.

abawany 4y ago

Also, some sites, such as Fidelity, now require the 2fa password on every login regardless of browser trust status.