4 ms·
Using a password manager as your authenticator seems very risky to me. You should use separate services. If your password manager is breached, at least the in
by tremarley 3y ago
Using a password manager as your authenticator seems very risky to me.
You should use separate services.
If your password manager is breached, at least the infiltrator cannot pass 2FA.
- lern_too_spel 3y agoIt is no different from Passkeys in that regard, yet we're fine with that. If you want extra security, you would have your password manager and your OTP generator on different devices, but only a small fraction of people do that. Storing your OTP generator secrets and your passwords in the same app provides a reasonable trade-off between security and convenience for most people.
- patrakov 3y agoLet me add: for services like GitHub that never log you out, 2FA is pure security theater. The only factor in this case is a browser cookie.