3 ms·

iOS’s inbuilt password manager supports TOTP second factor authentication right in the operating system, no app needed.

iknowstuff 3y ago
Yeah but no normie knows about it. It never prompts to store them.
__MatrixMan__ 3y ago
Isn't the point of a second factor that it's... Not the same as the first factor? My TOTP app password is one of the few that don't go into the password manager. Might as well make 'em compromise each separately.
- vel0city 3y ago
  Eh. It still makes the credentials rotating credentials instead of permanent credentials. If your username + password + single TOTP value gets stolen, they won't be able to re-auth once that credential gets invalidated. So say a site accidentally logs auth attempts, and someone finds the log. Sure, they know your username + password now, but they don't know a good current TOTP value. And TOTP values are supposed to be one-time-use, so even if they catch it quick it'll be invalid very fast. Its better than not having TOTP, but not quite as secure as it could be. Theoretically its still something you know and something you have in that its something you "know", the static password, and something you "have", the rolling TOTP generator.
  - __MatrixMan__ 3y ago
    If the password manager was compromised (not accessed without permission, but updated without permission) then it wouldn't be just the single TOTP value that leaked, it would be the underlying key. On a mobile device you might be a bit limited in how "distant" you can keep the two, since the vendor is typically almighty in that scenario. But in general, you have options and you might as well avoid keeping both eggs in the same basket.
    - vel0city 3y ago
      That's one vector of my "not quite as secure as it could be" statement was thinking about. Or of someone just managed to steal your phone and break into it. But, there are still other attacks that this setup protects against. Two-factor isn't "two device", two factor is two factors of authentication, where factors are generally: * something you know (password) * something you have (key handshake, totp generator) * something you are (biometrics) Storing your TOTP secrets next to your hard passwords is putting eggs in the same basket, I agree. But I'd prefer someone do this than just forego adding TOTP or multi-factor entirely. And in the end, even if you used two different apps on your phone you're still putting all your eggs in the same basket, which is a trade off tons of people are going to do. Even a lot of very security-conscious users will end up with some TOTP app and a separate password manager, chances are both apps will be installed on the same device. If that device gets thoroughly compromised there's potential for both apps to be attacked and compromised. If your OS vendor shipping malicious code is a realistic threat to you, or at least attackers being able to impersonate your OS vendor, you're probably going to end up getting compromised even if you split it out into two apps. You'd probably just want to avoid TOTP entirely and move to physical hardware cryptographic tokens.
- kccqzy 3y ago
  Accessing TOTP or passwords in the iOS built-in password manager requires someone to (1) have your phone; (2) pass a biometric authentication or a passcode authentication. That's the two factors right there.
  - __MatrixMan__ 3y ago
    Or to be able to push updates to the iOS built-in password manager: one factor.
    - kccqzy 3y ago
      My threat model doesn't include Apple or Google, the maker of the operating system. If you assume they could push an update to the built-in password manager, you need to assume they could push a keylogger that exfiltrates both your regular password and the password for your TOTP app.
      - __MatrixMan__ 3y ago
        Fair enough. They're who I'm mostly worried about. I've got the Google apps in a sandbox, so I think if they pushed such a thing they could only spy on my logins with them. Not that I have supreme faith in GrapheneOS to keep google in its box on a device that google made, but I do hope that it represents enough friction that I get excluded as an outlier from whatever abuses occur.

Yeah but no normie knows about it. It never prompts to store them.

Isn't the point of a second factor that it's... Not the same as the first factor? My TOTP app password is one of the few that don't go into the password manager. Might as well make 'em compromise each separately.

vel0city 3y ago
Eh. It still makes the credentials rotating credentials instead of permanent credentials. If your username + password + single TOTP value gets stolen, they won't be able to re-auth once that credential gets invalidated. So say a site accidentally logs auth attempts, and someone finds the log. Sure, they know your username + password now, but they don't know a good current TOTP value. And TOTP values are supposed to be one-time-use, so even if they catch it quick it'll be invalid very fast. Its better than not having TOTP, but not quite as secure as it could be. Theoretically its still something you know and something you have in that its something you "know", the static password, and something you "have", the rolling TOTP generator.
- __MatrixMan__ 3y ago
  If the password manager was compromised (not accessed without permission, but updated without permission) then it wouldn't be just the single TOTP value that leaked, it would be the underlying key. On a mobile device you might be a bit limited in how "distant" you can keep the two, since the vendor is typically almighty in that scenario. But in general, you have options and you might as well avoid keeping both eggs in the same basket.
  - vel0city 3y ago
    That's one vector of my "not quite as secure as it could be" statement was thinking about. Or of someone just managed to steal your phone and break into it. But, there are still other attacks that this setup protects against. Two-factor isn't "two device", two factor is two factors of authentication, where factors are generally: * something you know (password) * something you have (key handshake, totp generator) * something you are (biometrics) Storing your TOTP secrets next to your hard passwords is putting eggs in the same basket, I agree. But I'd prefer someone do this than just forego adding TOTP or multi-factor entirely. And in the end, even if you used two different apps on your phone you're still putting all your eggs in the same basket, which is a trade off tons of people are going to do. Even a lot of very security-conscious users will end up with some TOTP app and a separate password manager, chances are both apps will be installed on the same device. If that device gets thoroughly compromised there's potential for both apps to be attacked and compromised. If your OS vendor shipping malicious code is a realistic threat to you, or at least attackers being able to impersonate your OS vendor, you're probably going to end up getting compromised even if you split it out into two apps. You'd probably just want to avoid TOTP entirely and move to physical hardware cryptographic tokens.
kccqzy 3y ago
Accessing TOTP or passwords in the iOS built-in password manager requires someone to (1) have your phone; (2) pass a biometric authentication or a passcode authentication. That's the two factors right there.
- __MatrixMan__ 3y ago
  Or to be able to push updates to the iOS built-in password manager: one factor.
  - kccqzy 3y ago
    My threat model doesn't include Apple or Google, the maker of the operating system. If you assume they could push an update to the built-in password manager, you need to assume they could push a keylogger that exfiltrates both your regular password and the password for your TOTP app.
    - __MatrixMan__ 3y ago
      Fair enough. They're who I'm mostly worried about. I've got the Google apps in a sandbox, so I think if they pushed such a thing they could only spy on my logins with them. Not that I have supreme faith in GrapheneOS to keep google in its box on a device that google made, but I do hope that it represents enough friction that I get excluded as an outlier from whatever abuses occur.