3 ms·
If the device is exploited, they can also install a keylogger and steal regular passwords. I think this would be where hardware based authentication via TPM or
by chlorion 3y ago
If the device is exploited, they can also install a keylogger and steal regular passwords.
I think this would be where hardware based authentication via TPM or similar would be useful. This would allow the device to be taken over and the private key material would still be safe.
- dwaite 3y agoThey could also look at your SMS and Email OTP. The secrets in the password vault can be used to authenticate and change settings in various trusted systems, like configuring call forwarding. Cloud-based backups or the local filesystem could theoretically be inspected for software TOTP secrets. Responding to the potential for bad user choices and full compromise quickly gets you to the point where your options are separate hardware or requiring in-person confirmation. NIST 800-63-3 AAL3 is probably most appropriate to look at if your risk profile mandates this.