4 ms·
If you don't need a proper second factor, just set up TOTP and store it in KeePassXC. There is little benefit to a WebAuthn/FIFO "key" stored in your password m
by cyphar 3y ago
If you don't need a proper second factor, just set up TOTP and store it in KeePassXC. There is little benefit to a WebAuthn/FIFO "key" stored in your password manager over a password manager with your TOTP stored in it -- almost all of the benefits of WebAuthn (making phishing much harder) already exist with password managers that auto-fill.
There are usecases where you need proper multi-factor authentication, and in those cases you are either a professional (meaning you can handle backups yourself) or you're working for a large company where the management of the keys is done by IT and normal workers don't have to care about it.
- danShumway 3y agoI disagree that a proper key-based solution wouldn't have security benefits (auto-fill doesn't always work and is more vulnerable to phishing). But I also really want to be clear here that we are not talking about multi-factor authentication in the long run. The explicit goal of Google/Microsoft/Apple is to get rid of passwords. Passkey is designed as a replacement for passwords. It's not a replacement right now, but that is the intention, they are not thinking about having a Yubikey as a second-factor for login.
- cyphar 3y agoWhen I said "auto-fill", I was referring to auto-fill with a browser extension where the website is checked. Yes, the FIDO method is even nicer from a technical perspective, but from a security perspective they are similar. But of course, you can be phished into copying your password into a phishing site. So there are benefits, but it's not a huge difference in this one specific context (no physical token, using a password manager with a browser-extension-based auto-fill).
- throwaway2056 3y agoYou are lucky if you find a mum with 3 kids or cafe owner or a fruit seller using TOTP in keepassXC. Do you know they would prefer a phone (not laptop/desktop)? They dont have laptop.
- cyphar 3y agoThe HN article we are commenting on is about a PR to add a feature to KeePassXC.