4 ms·

IMO you don't have MFA if your codes are generated by your password manager.

zdw 3y ago
Does someone who has phone-based MFA and a phone-based password manager lack MFA? Does it matter if they're in the same app?
- iLoveOncall 3y ago
  Yes, very much, you can have different passwords on the two separate applications. This is also reductive because it doesn't take into account password managers used on a non-mobile device, where the benefits become obvious in that if one of your devices is comprised it's unlikely that the other is too.
- Brian_K_White 3y ago
  > Does someone who has phone-based MFA and a phone-based password manager lack MFA? Yes. Call that say 1.25 factors. It is of greater than zero value.
eddyg 3y ago
1Password covered this very well: https://blog.1password.com/1password-2fa-passwords-codes-together/ https://blog.1password.com/1password-2fa-passwords-codes-tog...
- smaccona 3y ago
  They tackled the subject for sure, but my takeaway from that blog posting is not that storing your TOTP tokens in 1Password is “as good as” having separate hardware devices for password storage management and TOTP management, but rather that storing your TOTP tokens in 1Password (or any password manager) is better than not using OTP at all. This of course is definitely true, and a definite improvement in security. I think a sibling referred to it as “1,25x” as secure, which feels about right (on some non-linear scale where 2.0 represents two unique factors). I don’t use a KeePass or similar device, and I do have my TOTP tokens on my phone (using the great OTP Auth app, no affiliation), but I do most of my work on a computer so I toyed with completely removing password management from my phone and just having the OTP app there. I haven’t committed to that that yet though. Another option is to use a cheap device such as an iPod Touch for OTP, though those are probably more expensive than a dedicated OTP device (I just happen to have one lying around unused).

zdw 3y ago

Does someone who has phone-based MFA and a phone-based password manager lack MFA? Does it matter if they're in the same app?

iLoveOncall 3y ago
Yes, very much, you can have different passwords on the two separate applications. This is also reductive because it doesn't take into account password managers used on a non-mobile device, where the benefits become obvious in that if one of your devices is comprised it's unlikely that the other is too.
Brian_K_White 3y ago
> Does someone who has phone-based MFA and a phone-based password manager lack MFA? Yes. Call that say 1.25 factors. It is of greater than zero value.

eddyg 3y ago

1Password covered this very well: https://blog.1password.com/1password-2fa-passwords-codes-together/ https://blog.1password.com/1password-2fa-passwords-codes-tog...

smaccona 3y ago
They tackled the subject for sure, but my takeaway from that blog posting is not that storing your TOTP tokens in 1Password is “as good as” having separate hardware devices for password storage management and TOTP management, but rather that storing your TOTP tokens in 1Password (or any password manager) is better than not using OTP at all. This of course is definitely true, and a definite improvement in security. I think a sibling referred to it as “1,25x” as secure, which feels about right (on some non-linear scale where 2.0 represents two unique factors). I don’t use a KeePass or similar device, and I do have my TOTP tokens on my phone (using the great OTP Auth app, no affiliation), but I do most of my work on a computer so I toyed with completely removing password management from my phone and just having the OTP app there. I haven’t committed to that that yet though. Another option is to use a cheap device such as an iPod Touch for OTP, though those are probably more expensive than a dedicated OTP device (I just happen to have one lying around unused).