3 ms·

Storing the TOTP in your password manager still protects against brute force / rainbow / phishing / MITM attacks. The author has come to their conclusion based

Storing the TOTP in your password manager still protects against brute force / rainbow / phishing / MITM attacks. The author has come to their conclusion based on one scenario without considering any others. For super important stuff, such as email accounts, I use an external authenticator. For medium important stuff where I want a bit of extra security (or I’m forced to use 2FA when I don’t want to), I store it in the password manager.

Wowfunhappy 4y ago
> brute force / rainbow If I'm using a long random password generated by a password manager, are these attacks realistic? > phishing / MITM attacks But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code? > (or I’m forced to use 2FA when I don’t want to) IMO, this is the only actual use-case, and it sucks because it adds additional login friction for absolutely no reason. If you want to ensure I'm using a strong password, generate the password for me as a condition of disabling 2FA.
- shortcake27 4y ago
  > If I'm using a long random password generated by a password manager, are these attacks realistic? Most likely no. But some people refuse to use such passwords, even when using password managers. Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea. > But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code? The TOTP lasts ~30 seconds. So the attack needs to occur in real-time (opposed to a form that just captures information). Can this happen? Absolutely. But it still raises the bar for the attack. But yeah I agree, forced 2FA is infuriating.
  - gregmac 4y ago
    > Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea. Though that site is likely also storing the TOTP shared secret in plaintext, beside the password, making it pretty much pointless. If the site itself is compromised, it's hard to come back from that. Pretty much the best thing you can do is never re-use passwords across sites.
  - gnabgib 4y ago
    Both the time-step size (recommended 30s, 60s isn't uncommon) and the validity window (+-1 (3 windows), +-2 (5 windows)) are configurable by the implementation. The time-step size can't be changed after the setup (both the server and the client would have to agree) and are visible to you. The validity window can be altered server side and isn't visible to a user. It's in the best interests of implementer to keep the validity window small since they have to check all valid TOTP codes for a client, but the phishing window while near-time, is larger than the time your code is visible.[0] [0]: https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238
thewataccount 4y ago
AFAIK TOTP doesn't provide protection against phishing / MITM attacks if the attacker is able to response within the time window (usually ~2x 30 seconds). It also has limited benefit against brute force attacks since it's essentially just a few extra numbers added to the password (although that certainly helps). It does provide a defense against leaked previously passwords, and keyloggers if they aren't immediately used. I'd love to be corrected if this isn't the case though. EDIT: Totally forgot - it also protects you if your password manager is breached, assuming you don't store it in the password manager
- corvec 4y ago
  If you use the browser extension, it provides resistance against phishing attacks because the password and TOTP won't auto-populate. It doesn't help against sophisticated MITM attacks at all - for those you need U2F / WebAuthn. It helps against brute force attacks but how much it helps depends on the service. If your service prompts for a 2FA code when provided with an incorrect password, then it helps a lot. If an attacker receives confirmation that they have a correct password before needing to enter the 2FA code, then it helps less.
- shortcake27 4y ago
  > AFAIK TOTP doesn't provide protection against phishing / MITM attacks if the attacker is able to response within the time window (usually ~2x 30 seconds). This assumes a sophisticated attack, which is absolutely possible (I’ve even seen it happen), but is less likely than a form that just captures information. In any case, in the attack you describe, storing the TOTP externally doesn’t provide any additional protection over storing it within the password manager. > EDIT: Totally forgot - it also protects you if your password manager is breached, assuming you don't store it in the password manager Yeah that’s the entire point of the article. But managing TOTP separately can be a bit painful. So I’m saying that if you want a bit of additional security without any inconvenience, there are still benefits to storing a TOTP in your password manager opposed to having no MFA at all.
  - thewataccount 4y ago

Wowfunhappy 4y ago

> brute force / rainbow If I'm using a long random password generated by a password manager, are these attacks realistic? > phishing / MITM attacks But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code? > (or I’m forced to use 2FA when I don’t want to) IMO, this is the only actual use-case, and it sucks because it adds additional login friction for absolutely no reason. If you want to ensure I'm using a strong password, generate the password for me as a condition of disabling 2FA.

shortcake27 4y ago
> If I'm using a long random password generated by a password manager, are these attacks realistic? Most likely no. But some people refuse to use such passwords, even when using password managers. Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea. > But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code? The TOTP lasts ~30 seconds. So the attack needs to occur in real-time (opposed to a form that just captures information). Can this happen? Absolutely. But it still raises the bar for the attack. But yeah I agree, forced 2FA is infuriating.
- gregmac 4y ago
  > Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea. Though that site is likely also storing the TOTP shared secret in plaintext, beside the password, making it pretty much pointless. If the site itself is compromised, it's hard to come back from that. Pretty much the best thing you can do is never re-use passwords across sites.
- gnabgib 4y ago
  Both the time-step size (recommended 30s, 60s isn't uncommon) and the validity window (+-1 (3 windows), +-2 (5 windows)) are configurable by the implementation. The time-step size can't be changed after the setup (both the server and the client would have to agree) and are visible to you. The validity window can be altered server side and isn't visible to a user. It's in the best interests of implementer to keep the validity window small since they have to check all valid TOTP codes for a client, but the phishing window while near-time, is larger than the time your code is visible.[0] [0]: https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238

thewataccount 4y ago

AFAIK TOTP doesn't provide protection against phishing / MITM attacks if the attacker is able to response within the time window (usually ~2x 30 seconds). It also has limited benefit against brute force attacks since it's essentially just a few extra numbers added to the password (although that certainly helps). It does provide a defense against leaked previously passwords, and keyloggers if they aren't immediately used. I'd love to be corrected if this isn't the case though. EDIT: Totally forgot - it also protects you if your password manager is breached, assuming you don't store it in the password manager

corvec 4y ago
If you use the browser extension, it provides resistance against phishing attacks because the password and TOTP won't auto-populate. It doesn't help against sophisticated MITM attacks at all - for those you need U2F / WebAuthn. It helps against brute force attacks but how much it helps depends on the service. If your service prompts for a 2FA code when provided with an incorrect password, then it helps a lot. If an attacker receives confirmation that they have a correct password before needing to enter the 2FA code, then it helps less.
shortcake27 4y ago
> AFAIK TOTP doesn't provide protection against phishing / MITM attacks if the attacker is able to response within the time window (usually ~2x 30 seconds). This assumes a sophisticated attack, which is absolutely possible (I’ve even seen it happen), but is less likely than a form that just captures information. In any case, in the attack you describe, storing the TOTP externally doesn’t provide any additional protection over storing it within the password manager. > EDIT: Totally forgot - it also protects you if your password manager is breached, assuming you don't store it in the password manager Yeah that’s the entire point of the article. But managing TOTP separately can be a bit painful. So I’m saying that if you want a bit of additional security without any inconvenience, there are still benefits to storing a TOTP in your password manager opposed to having no MFA at all.
- thewataccount 4y ago