3 ms·
There's no way to construct a TOTP app that uses that TOTP secret to actually encrypt the on-disk password database though, correct? In the case where e.g. Last
by nightpool 4y ago
There's no way to construct a TOTP app that uses that TOTP secret to actually encrypt the on-disk password database though, correct? In the case where e.g. LastPass gets breached, even if you have 2FA enabled, the only thing actually protecting your vault is the Master Password itself, not the TOTP code? Since there's no way to use a TOTP code cryptographically to prove anything other then a shared secret.
In theory some sort of HSM like a Yubikey could do it, but in practice I'm not aware of any password managers that use that feature (other than maybe one or two obscure KeePass plugins?)
Similarly, that's why 1Password is more secure than BitWarden or LastPass, because it has a separate "master key file" that's required in addition to your password to set up your vault.
- powersnail 4y agoIn case of a breach, yes. That's why I said "theoretically". In practice, spreading the factors across different services probably have some benefits (provided that they don't unlock each other). But breach is ultimately a separate issue from authentication.
- nightpool 4y ago> But breach is ultimately a separate issue from authentication. It's the fundamental security threat model that all password managers are built under, even LastPass. They all are built to ensure that your passwords are secure even if the password manager's cloud service is compromised.