3 ms·

> it distracts me It would be faster if a password manager is used with browser plug-in. > It forces me to have a smart phone Not if we're talking about TOTP

> it distracts me It would be faster if a password manager is used with browser plug-in. > It forces me to have a smart phone Not if we're talking about TOTP. The information for that can be stored in a password manager. > Or couples online with offline Not if you use a password manager. > it can be replaced with other solutions TOTP + password manager is more convenient (and more online) than yubikey, in my opinion. Especially convenient with a browser plugin. My chosen pm is KeePassXC, would highly recommend. One caveat: I hate non-TOTP MFA. It's either proprietary lock-in or less secure.

dishsoap 3y ago
> One caveat: I hate non-TOTP MFA. It's either proprietary lock-in or less secure. Agreed. A particular pain point for me is Apple's proprietary (or SMS-based, even worse) iCloud 2FA, it's just awful. I would use TOTP/HOTP for it in a heartbeat if given the option.
- jackson1442 3y ago
  They support standard hardware keys now, which have worked pretty well for me. Just can’t use them if you have devices which aren’t on one of the later OS updates since the OS won’t support signing in with a yubikey.
arccy 3y ago
without a browser plugin or something better than human eyes to verify domain matches, password + totp are phishable / mitm-able in an online attack
- djha-skin 3y ago
  A fact that becomes important in some contexts. Nevertheless I still feel it is the best compromise between convenience and security available to us.
iLoveOncall 3y ago
IMO you don't have MFA if your codes are generated by your password manager.
- zdw 3y ago
  Does someone who has phone-based MFA and a phone-based password manager lack MFA? Does it matter if they're in the same app?
  - iLoveOncall 3y ago
    Yes, very much, you can have different passwords on the two separate applications. This is also reductive because it doesn't take into account password managers used on a non-mobile device, where the benefits become obvious in that if one of your devices is comprised it's unlikely that the other is too.
  - Brian_K_White 3y ago
    > Does someone who has phone-based MFA and a phone-based password manager lack MFA? Yes. Call that say 1.25 factors. It is of greater than zero value.
- eddyg 3y ago
  1Password covered this very well: https://blog.1password.com/1password-2fa-passwords-codes-together/ https://blog.1password.com/1password-2fa-passwords-codes-tog...
  - smaccona 3y ago
    They tackled the subject for sure, but my takeaway from that blog posting is not that storing your TOTP tokens in 1Password is “as good as” having separate hardware devices for password storage management and TOTP management, but rather that storing your TOTP tokens in 1Password (or any password manager) is better than not using OTP at all. This of course is definitely true, and a definite improvement in security. I think a sibling referred to it as “1,25x” as secure, which feels about right (on some non-linear scale where 2.0 represents two unique factors). I don’t use a KeePass or similar device, and I do have my TOTP tokens on my phone (using the great OTP Auth app, no affiliation), but I do most of my work on a computer so I toyed with completely removing password management from my phone and just having the OTP app there. I haven’t committed to that that yet though. Another option is to use a cheap device such as an iPod Touch for OTP, though those are probably more expensive than a dedicated OTP device (I just happen to have one lying around unused).
zdw 3y ago
Agree, non-TOPT MFA is a scourge. It's criminal that Google requires you to set up a phone-based or proprietary MFA before you can switch to TOPT. Your phone number isn't something you "have" - it's something you're renting from another big company, and their security has obvious reset holes made to cope with unsophisticated users, therefore is worse than a password managers. The only workaround I've found that is non-distracting is to have a dedicated phone-to-web/email system... Google Voice works for this if you're US based.
- eternityforest 3y ago
  I greatly prefer SMS auth(At least for personal stuff, I see the value of TOTP for work) because of exactly those reset holes. For low value targets it's not really much of an issue, and makes it much harder to get locked out of your account, which would be almost as much of a problem as getting hacked.
pdonis 3y ago
Unfortunately, in my experience, there is lots of MFA out there that doesn't support TOTP (many providers probably don't even know it exists).
kenmacd 3y ago
> TOTP + password manager is more convenient (and more online) than yubikey, in my opinion. Especially convenient with a browser plugin. More convenient than yubikey webauthn, or just yubikey TOTP? Personally I find tapping my yubikey much easier than any 'enter the code' 2FA. Also it should be noted that storing your TOTP secret in the same place as your password means you're one malware attack away from losing access to that account. While this risk may be acceptable for many accounts, it should at least be considered.
- djha-skin 3y ago
  The security implications are indeed a debate, but really any attack on the password manager is a huge security problem anyway so you might as well store the TOTP information there. One way to mitigate this is to use offline password managers such as keepassXC (which I use) and non-proprietary sync stuff such as syncthing (but I just use a cloud drive provider). Entering a code is easy because of the password manager plug in. I don't have to find the Key with my finger, I just have to click with the mouse. Much easier.
  - chkaloon 3y ago
    If your password manager is hacked, but your TOTP info is offline, how is this not better that having TOTP info in your password manager? Also not sure how syncing through a cloud drive is any better than a cloud password manager.
    - SturgeonsLaw 3y ago
      > Also not sure how syncing through a cloud drive is any better than a cloud password manager. The private keys stay on your machine
      - chkaloon 3y ago
        Not if you're using a commercial cloud drive
    - 3y ago
allset_ 3y ago
WebAuthn is more secure, easier to use, and is not proprietary.
KolenCh 3y ago
Did the one you hate include Duo? That’s the only one I’m using that is not TOTP based. But eventually I find a way to get the secret and generate the 2-factor myself. I agree with you about using a password manager to solve these kind of problems. One thing people don’t understand is we have collaborators that need to deploy to a Chile desert where the environment is so bad that your mobile phone would likely die there. (It’s not recommended to bring one anyway.) So all these solutions requiring a 2nd device, usually a mobile phone, is very annoying. The most annoying part is that these security policy is enforced by central university who don’t care about the requirements of a research project. But frankly, even if there’s a way to do it with a password manager (using site computing for example so no mobile is necessary), this is not presented as the way to use MFA, and some would consider it a breach of security.

dishsoap 3y ago

> One caveat: I hate non-TOTP MFA. It's either proprietary lock-in or less secure. Agreed. A particular pain point for me is Apple's proprietary (or SMS-based, even worse) iCloud 2FA, it's just awful. I would use TOTP/HOTP for it in a heartbeat if given the option.

jackson1442 3y ago
They support standard hardware keys now, which have worked pretty well for me. Just can’t use them if you have devices which aren’t on one of the later OS updates since the OS won’t support signing in with a yubikey.

arccy 3y ago

without a browser plugin or something better than human eyes to verify domain matches, password + totp are phishable / mitm-able in an online attack

djha-skin 3y ago
A fact that becomes important in some contexts. Nevertheless I still feel it is the best compromise between convenience and security available to us.

iLoveOncall 3y ago

IMO you don't have MFA if your codes are generated by your password manager.

zdw 3y ago
Does someone who has phone-based MFA and a phone-based password manager lack MFA? Does it matter if they're in the same app?
- iLoveOncall 3y ago
  Yes, very much, you can have different passwords on the two separate applications. This is also reductive because it doesn't take into account password managers used on a non-mobile device, where the benefits become obvious in that if one of your devices is comprised it's unlikely that the other is too.
- Brian_K_White 3y ago
  > Does someone who has phone-based MFA and a phone-based password manager lack MFA? Yes. Call that say 1.25 factors. It is of greater than zero value.
eddyg 3y ago
1Password covered this very well: https://blog.1password.com/1password-2fa-passwords-codes-together/ https://blog.1password.com/1password-2fa-passwords-codes-tog...
- smaccona 3y ago
  They tackled the subject for sure, but my takeaway from that blog posting is not that storing your TOTP tokens in 1Password is “as good as” having separate hardware devices for password storage management and TOTP management, but rather that storing your TOTP tokens in 1Password (or any password manager) is better than not using OTP at all. This of course is definitely true, and a definite improvement in security. I think a sibling referred to it as “1,25x” as secure, which feels about right (on some non-linear scale where 2.0 represents two unique factors). I don’t use a KeePass or similar device, and I do have my TOTP tokens on my phone (using the great OTP Auth app, no affiliation), but I do most of my work on a computer so I toyed with completely removing password management from my phone and just having the OTP app there. I haven’t committed to that that yet though. Another option is to use a cheap device such as an iPod Touch for OTP, though those are probably more expensive than a dedicated OTP device (I just happen to have one lying around unused).

zdw 3y ago

Agree, non-TOPT MFA is a scourge. It's criminal that Google requires you to set up a phone-based or proprietary MFA before you can switch to TOPT. Your phone number isn't something you "have" - it's something you're renting from another big company, and their security has obvious reset holes made to cope with unsophisticated users, therefore is worse than a password managers. The only workaround I've found that is non-distracting is to have a dedicated phone-to-web/email system... Google Voice works for this if you're US based.

eternityforest 3y ago
I greatly prefer SMS auth(At least for personal stuff, I see the value of TOTP for work) because of exactly those reset holes. For low value targets it's not really much of an issue, and makes it much harder to get locked out of your account, which would be almost as much of a problem as getting hacked.

pdonis 3y ago

Unfortunately, in my experience, there is lots of MFA out there that doesn't support TOTP (many providers probably don't even know it exists).

kenmacd 3y ago

> TOTP + password manager is more convenient (and more online) than yubikey, in my opinion. Especially convenient with a browser plugin. More convenient than yubikey webauthn, or just yubikey TOTP? Personally I find tapping my yubikey much easier than any 'enter the code' 2FA. Also it should be noted that storing your TOTP secret in the same place as your password means you're one malware attack away from losing access to that account. While this risk may be acceptable for many accounts, it should at least be considered.

djha-skin 3y ago
The security implications are indeed a debate, but really any attack on the password manager is a huge security problem anyway so you might as well store the TOTP information there. One way to mitigate this is to use offline password managers such as keepassXC (which I use) and non-proprietary sync stuff such as syncthing (but I just use a cloud drive provider). Entering a code is easy because of the password manager plug in. I don't have to find the Key with my finger, I just have to click with the mouse. Much easier.
- chkaloon 3y ago
  If your password manager is hacked, but your TOTP info is offline, how is this not better that having TOTP info in your password manager? Also not sure how syncing through a cloud drive is any better than a cloud password manager.
  - SturgeonsLaw 3y ago
    > Also not sure how syncing through a cloud drive is any better than a cloud password manager. The private keys stay on your machine
    - chkaloon 3y ago
      Not if you're using a commercial cloud drive
  - 3y ago

allset_ 3y ago

WebAuthn is more secure, easier to use, and is not proprietary.

KolenCh 3y ago

Did the one you hate include Duo? That’s the only one I’m using that is not TOTP based. But eventually I find a way to get the secret and generate the 2-factor myself. I agree with you about using a password manager to solve these kind of problems. One thing people don’t understand is we have collaborators that need to deploy to a Chile desert where the environment is so bad that your mobile phone would likely die there. (It’s not recommended to bring one anyway.) So all these solutions requiring a 2nd device, usually a mobile phone, is very annoying. The most annoying part is that these security policy is enforced by central university who don’t care about the requirements of a research project. But frankly, even if there’s a way to do it with a password manager (using site computing for example so no mobile is necessary), this is not presented as the way to use MFA, and some would consider it a breach of security.