3 ms·

> It may be better security but I don't care, I don't want to use it for anything except my bank accounts. Go with the time and accept that 2FA everywhere is g

> It may be better security but I don't care, I don't want to use it for anything except my bank accounts. Go with the time and accept that 2FA everywhere is good and the norm. As someone else mentioned: Browser-integrated password managers can autofill 2FA for you, meaning there's no extra hassle needing to lookup, copy, paste & confirm an extra step.

chungy 3y ago
> Browser-integrated password managers can autofill 2FA for you Meaning that it defeats the entire point of 2FA. 2FA used in this way is only security theater.
- roboben 3y ago
  Never understood the point of storing your 2fa where your passwords are.
  - zyrthofar 3y ago
    If your password manager gets compromised, sure, but if someone gets access to a website's database with password hashes, the 2fa is a pretty big part that they're missing.
    - TheSwordsman 3y ago
      This does assume they aren't able to also compromise the encryption key used to protect the secret: https://news.ycombinator.com/item?id=10845985 https://news.ycombinator.com/item?id=10845985 https://news.ycombinator.com/item?id=11136948 https://news.ycombinator.com/item?id=11136948
- whirlwin 3y ago
  I have raised this point so many times. People tend to forget why they are using a particular technology in the first place
- TheSwordsman 3y ago
  So as I mentioned in another comment, it's not entirely security theater. If the site enforces that an MFA token is truly one time use, then this can prevent replay attacks of your credentials being used to create a new session. If someone compromised your password store, then yeah it's all over. But if the compromise happens elsewhere, it can be a useful layer to the security onion.
- dzhiurgis 3y ago
  I agree, but not entirely. I.e. you can steal a password, but normally no password manage would allow you to export underlying 2FA code.
- alanfranz 3y ago
  Why? It depends on your scenario. If it is “attacker gets hold of my wallet” then yes, you’re screwed. But 2FA still helps if a single password was leaked/bruteforced/phished, and afaict most password managers in autofill mode recognize the browser url, so it’s quite phising safe (2nd factor won’t be autofilled on wrong website) Security is not binary, and 2fa via password manager is still much better than no 2fa; it’s not pointless.
bdcravens 3y ago
Agree with others that you shouldn't use your password manager as your 2FA provider, but depending on your mix of phone and computer, it's possible to copy and paste from phone to computer (maybe require a bit of setup on anything other than iOS to Mac)
- alanfranz 3y ago
  (Copypasting my answer to another comment) Why? It depends on your scenario. If it is “attacker gets hold of my wallet” then yes, you’re screwed. But 2FA still helps if a single password was leaked/bruteforced/phished, and afaict most password managers in autofill mode recognize the browser url, so it’s quite phishing safe (2nd factor won’t be autofilled on wrong website) Security is not binary, and 2fa via password manager is still much better than no 2fa; it’s not pointless.

chungy 3y ago

> Browser-integrated password managers can autofill 2FA for you Meaning that it defeats the entire point of 2FA. 2FA used in this way is only security theater.

roboben 3y ago
Never understood the point of storing your 2fa where your passwords are.
- zyrthofar 3y ago
  If your password manager gets compromised, sure, but if someone gets access to a website's database with password hashes, the 2fa is a pretty big part that they're missing.
  - TheSwordsman 3y ago
    This does assume they aren't able to also compromise the encryption key used to protect the secret: https://news.ycombinator.com/item?id=10845985 https://news.ycombinator.com/item?id=10845985 https://news.ycombinator.com/item?id=11136948 https://news.ycombinator.com/item?id=11136948
whirlwin 3y ago
I have raised this point so many times. People tend to forget why they are using a particular technology in the first place
TheSwordsman 3y ago
So as I mentioned in another comment, it's not entirely security theater. If the site enforces that an MFA token is truly one time use, then this can prevent replay attacks of your credentials being used to create a new session. If someone compromised your password store, then yeah it's all over. But if the compromise happens elsewhere, it can be a useful layer to the security onion.
dzhiurgis 3y ago
I agree, but not entirely. I.e. you can steal a password, but normally no password manage would allow you to export underlying 2FA code.
alanfranz 3y ago
Why? It depends on your scenario. If it is “attacker gets hold of my wallet” then yes, you’re screwed. But 2FA still helps if a single password was leaked/bruteforced/phished, and afaict most password managers in autofill mode recognize the browser url, so it’s quite phising safe (2nd factor won’t be autofilled on wrong website) Security is not binary, and 2fa via password manager is still much better than no 2fa; it’s not pointless.

bdcravens 3y ago

Agree with others that you shouldn't use your password manager as your 2FA provider, but depending on your mix of phone and computer, it's possible to copy and paste from phone to computer (maybe require a bit of setup on anything other than iOS to Mac)

alanfranz 3y ago
(Copypasting my answer to another comment) Why? It depends on your scenario. If it is “attacker gets hold of my wallet” then yes, you’re screwed. But 2FA still helps if a single password was leaked/bruteforced/phished, and afaict most password managers in autofill mode recognize the browser url, so it’s quite phishing safe (2nd factor won’t be autofilled on wrong website) Security is not binary, and 2fa via password manager is still much better than no 2fa; it’s not pointless.