4 ms·

If your password manager is locked by 1) a password that isn’t written down, and 2) a second factor code, it’s theoretically equivalent to having a specialized

If your password manager is locked by 1) a password that isn’t written down, and 2) a second factor code, it’s theoretically equivalent to having a specialized TOTP app, (assuming the password manager won’t get cracked). For instance: - to get into my gmail, you’ll need my password and TOTP. - both the password and TOTP are stored in my password manager, so you need to unlock my password manager. - to unlock my password manager, you need its password, and its 2-factor code. - the password isn’t written down so you’ll need to know it - the 2-factor code is only accessible on a device, so you’ll need one of my device. - thus, to get into my email, you need both to know something and have something of my belonging. That is of course based on the presumption that you trust the password manager’s implementation.

ghusto 4y ago
Yeah basically this. If you've managed to get into my password manager, it means you must have gained access to my machine whilst it was unlocked (and my password manager was unlocked too). If that's the case, you already have access to live sessions to most of the things stored in my password manager. Essentially, if you have access to my password manager, I am completely fucked anyway, whether my OTP codes are in there or not.
nightpool 4y ago
There's no way to construct a TOTP app that uses that TOTP secret to actually encrypt the on-disk password database though, correct? In the case where e.g. LastPass gets breached, even if you have 2FA enabled, the only thing actually protecting your vault is the Master Password itself, not the TOTP code? Since there's no way to use a TOTP code cryptographically to prove anything other then a shared secret. In theory some sort of HSM like a Yubikey could do it, but in practice I'm not aware of any password managers that use that feature (other than maybe one or two obscure KeePass plugins?) Similarly, that's why 1Password is more secure than BitWarden or LastPass, because it has a separate "master key file" that's required in addition to your password to set up your vault.
- powersnail 4y ago
  In case of a breach, yes. That's why I said "theoretically". In practice, spreading the factors across different services probably have some benefits (provided that they don't unlock each other). But breach is ultimately a separate issue from authentication.
  - nightpool 4y ago
    > But breach is ultimately a separate issue from authentication. It's the fundamental security threat model that all password managers are built under, even LastPass. They all are built to ensure that your passwords are secure even if the password manager's cloud service is compromised.

ghusto 4y ago

Yeah basically this. If you've managed to get into my password manager, it means you must have gained access to my machine whilst it was unlocked (and my password manager was unlocked too). If that's the case, you already have access to live sessions to most of the things stored in my password manager. Essentially, if you have access to my password manager, I am completely fucked anyway, whether my OTP codes are in there or not.

nightpool 4y ago

There's no way to construct a TOTP app that uses that TOTP secret to actually encrypt the on-disk password database though, correct? In the case where e.g. LastPass gets breached, even if you have 2FA enabled, the only thing actually protecting your vault is the Master Password itself, not the TOTP code? Since there's no way to use a TOTP code cryptographically to prove anything other then a shared secret. In theory some sort of HSM like a Yubikey could do it, but in practice I'm not aware of any password managers that use that feature (other than maybe one or two obscure KeePass plugins?) Similarly, that's why 1Password is more secure than BitWarden or LastPass, because it has a separate "master key file" that's required in addition to your password to set up your vault.

powersnail 4y ago
In case of a breach, yes. That's why I said "theoretically". In practice, spreading the factors across different services probably have some benefits (provided that they don't unlock each other). But breach is ultimately a separate issue from authentication.
- nightpool 4y ago
  > But breach is ultimately a separate issue from authentication. It's the fundamental security threat model that all password managers are built under, even LastPass. They all are built to ensure that your passwords are secure even if the password manager's cloud service is compromised.