4 ms·

For me it’s separation of secrets. If my vault is exposed they won’t be able to log in without the codes. Putting it all in one place is a bad idea, some may th

For me it’s separation of secrets. If my vault is exposed they won’t be able to log in without the codes. Putting it all in one place is a bad idea, some may think.

nerdponx 3y ago
You can have one database for passwords and another for OTP.
alwayslikethis 3y ago
What if you lost or somehow broke the phone? You'll be locked out your stuff faster than you'd expect. If you back it up to a cloud service, are you sure you can recover it without the TOTP? If you are backing it up to your computer, then it's already on your computer and will probably be compromised when your vault is, so you might as well use your vault anyways.
- sodality2 3y ago
  I load my TOTP tokens into two phones, one that stays at home fully charged. If I lose them, I can easily reset my TOTP with any reasonable provider - I have the account login and password, and can authenticate with my email/provide proof of identity.
pseufaux 3y ago
1Password wrote a blog post stating something similar. Basically it comes down to if you're using TOTP as a true second factor. If you are it really shouldn't even be accessible from the same device. https://blog.1password.com/totp-and-1password/ https://blog.1password.com/totp-and-1password/
- alwayslikethis 3y ago
  I suspect most people aren't though. Most people are just being forced or nudged to using it. The main purpose for platform providers to push TOTP is probably consumers reusing passwords leading to account compromise, but if you are using a password manager, you can generate high entropy single-use passwords which don't really have that problem.
  - Borealid 3y ago
    A TOTP protects you against a replay of your password after it's typed into a compromised computer.
Tmpod 3y ago
Yeah, that's why I also don't use the OTP features in Bitwarden (Premium), despite using the software as my password manager. On my computer, I also use a distinct password to protect my pass-otp secrets.
DinaCoder99 3y ago
The conflict between single point of authentication and single point of failure is intractable. Just pick a poison based on which is less likely to fuck you over.

For me it’s separation of secrets. If my vault is exposed they won’t be able to log in without the codes. Putting it all in one place is a bad idea, some may think.

nerdponx 3y ago

You can have one database for passwords and another for OTP.

alwayslikethis 3y ago

What if you lost or somehow broke the phone? You'll be locked out your stuff faster than you'd expect. If you back it up to a cloud service, are you sure you can recover it without the TOTP? If you are backing it up to your computer, then it's already on your computer and will probably be compromised when your vault is, so you might as well use your vault anyways.

sodality2 3y ago
I load my TOTP tokens into two phones, one that stays at home fully charged. If I lose them, I can easily reset my TOTP with any reasonable provider - I have the account login and password, and can authenticate with my email/provide proof of identity.

pseufaux 3y ago

1Password wrote a blog post stating something similar. Basically it comes down to if you're using TOTP as a true second factor. If you are it really shouldn't even be accessible from the same device. https://blog.1password.com/totp-and-1password/ https://blog.1password.com/totp-and-1password/

alwayslikethis 3y ago
I suspect most people aren't though. Most people are just being forced or nudged to using it. The main purpose for platform providers to push TOTP is probably consumers reusing passwords leading to account compromise, but if you are using a password manager, you can generate high entropy single-use passwords which don't really have that problem.
- Borealid 3y ago
  A TOTP protects you against a replay of your password after it's typed into a compromised computer.

Tmpod 3y ago

Yeah, that's why I also don't use the OTP features in Bitwarden (Premium), despite using the software as my password manager. On my computer, I also use a distinct password to protect my pass-otp secrets.

DinaCoder99 3y ago

The conflict between single point of authentication and single point of failure is intractable. Just pick a poison based on which is less likely to fuck you over.