3 ms·

The main point of TOTP is that users passwords are mostly weak and reused across sites. TOTP protects those users from password stuffing and similar attacks. I

• xyzzy_plugh 3y ago
  Furthermore the risk exposure to using TOTO in 1pw is almost insignificant. You can configure your 1password account to require 2FA when setting up new devices, and unlike Google here the decryption requires manual knowledge not shared with the cloud. The only argument I can imagine is that if someone gets ahold of your phone it's either locked and they can unlock it or it's unlocked, in which case either your 1pw account and/or other TOTP apps are either locked or unlocked. In the worst case scenario where everything is unlocked, having a separate app is negligible. Besides, AFAIK Google Authenticator doesn't require additional unlock steps, unlike authy or 1password. You're better off worrying about how to avoid TOTP and securing 1password than about having TOTP codes stored alongside your passwords.
• tasuki 3y ago
  > If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. Why isn't TOTP buying much additional security? It seems to me that apart from password reuse it's mitigating many other potential problems: keyloggers leaking passwords from your device, passwords leaking from the authenticating server, etc.
  • lll-o-lll 3y ago
    Totp seeds leak from servers just as easily as passwords do.
    • computerfriend 3y ago
      One way passwords leak from servers is when they're being inappropriately logged (like at the POST-level), which is not going to happen for TOTP seeds.
      • lll-o-lll 3y ago
        True enough. However, unlike a password, you can’t take a hash of it and thus reduce the consequence of exposure. It’s just another shared secret, albeit one that doesn’t rely on the fallibility of human creation. The only good solution is WebAuthn and related technologies (phone passkeys for disaster recovery), so that server side needs nothing more than a public key.
  • tedd4u 3y ago
    Not exactly the question you asked but one reason FIDO/Ubikey provides more protection than TOTP is that it won't send codes to the wrong website. If you're being phished skillfully, and don't notice the URL is wrong, you're protected in that way. If you use TOTP you have to verify the URL manually.
• Takennickname 3y ago
  It literally protects you from key loggers. Isn't that important?
  • psanford 3y ago
    In practice, no. Key loggers are a minuscule threat to account security compared to weak passwords and password reuse. But lets say you are in fact a user that gets targeted by an adversary capable of deploying a key logger against you. Does TOTP protect you? No! If you are compromised to that point, the attacker is also in a position to just hijack your sessions. There isn't a threat model out there that is trying to solve the problem of "my end user device has been compromised but I still want to be able to use it to access sensitive systems without those systems being compromised."
    • hirsin 3y ago
      Token binding was the closest we had - still lets a compromised endpoint in the right position steal and use the tokens from that device, but it's at least not persistent.
    • Takennickname 3y ago
      True
    • NoZebra120vClip 3y ago
      Keyloggers may not threaten people who habitually use personal devices, but I can see them still looming large for those who rely on public computers, in libraries, schools, coworking spaces, etc. YMMV.