7 ms·

If your 2FA code is as autocompletable as your password, is it really a second factor?

CGamesPlay 2y ago
Possibly. But this appears to be for SMS-based 2 factor, so you'll need your phone nearby.
nicce 2y ago
2FA code (rng seed) can be stored to password managers directly as well. It is access requirement for something else, which fulfills the criteria of 2FA. In this case, there is requirement to access the browser and phone.
- k8sToGo 2y ago
  But if you have it in the PW manager, isn’t it moot? I guess it’s still safe against leaking of your password only.
  - LelouBil 2y ago
    Yes, you're completely right. It depends on your threat model vs usability/ease of use.
- deleted 2y ago
  [deleted]
bayindirh 2y ago
I personally don't think so. It's something you know + something you have with you. If your computer is compromised, the 2FA should be somewhere else, not in a keychain. This is why I like Yubikey and other forms of 2FA (phone based TOTP, mostly).
- deleted 2y ago
  [deleted]
eschatology 2y ago
Yes — because 2FA is commonly stored on a separate device (phone), people are very quick to conclude that it is pointless otherwise without thinking further. Even if it is stored in your password manager, it is still useful. Consider the case where your network or website is compromised: the password is compromised and can be reused, but the totp 2fa that is in your password manager still prevents login by anyone who obtained your password. There are many attack scenarios but storing 2fa and enabling autocomplete definitely does not make it useless.
- dheera 2y ago
  Also I'm sick and tired of every business thinking that a phone has to be the second factor. A laptop, or even better, a large, immobile desktop PC, is a much better second factor than a phone, and there is no reason why a user should be forced to go find their phone when they have console access to a much larger device. Putting a Yubikey semi-permanently on every device and having you do a one-time registration of each device (initially using another already-registered device) should be the default way of implementing 2FA.
- dylan604 2y ago
  But what if it is an app on the phone that is asking for that 2FA which then receives that 2FA via text?
eli 2y ago
OK, so it's a passkey for sites that don't support passkeys. I'm fine with that.

Possibly. But this appears to be for SMS-based 2 factor, so you'll need your phone nearby.

2FA code (rng seed) can be stored to password managers directly as well. It is access requirement for something else, which fulfills the criteria of 2FA. In this case, there is requirement to access the browser and phone.

k8sToGo 2y ago
But if you have it in the PW manager, isn’t it moot? I guess it’s still safe against leaking of your password only.
- LelouBil 2y ago
  Yes, you're completely right. It depends on your threat model vs usability/ease of use.
deleted 2y ago
[deleted]

bayindirh 2y ago

I personally don't think so. It's something you know + something you have with you. If your computer is compromised, the 2FA should be somewhere else, not in a keychain. This is why I like Yubikey and other forms of 2FA (phone based TOTP, mostly).

deleted 2y ago
[deleted]

eschatology 2y ago

Yes — because 2FA is commonly stored on a separate device (phone), people are very quick to conclude that it is pointless otherwise without thinking further. Even if it is stored in your password manager, it is still useful. Consider the case where your network or website is compromised: the password is compromised and can be reused, but the totp 2fa that is in your password manager still prevents login by anyone who obtained your password. There are many attack scenarios but storing 2fa and enabling autocomplete definitely does not make it useless.

dheera 2y ago
Also I'm sick and tired of every business thinking that a phone has to be the second factor. A laptop, or even better, a large, immobile desktop PC, is a much better second factor than a phone, and there is no reason why a user should be forced to go find their phone when they have console access to a much larger device. Putting a Yubikey semi-permanently on every device and having you do a one-time registration of each device (initially using another already-registered device) should be the default way of implementing 2FA.
dylan604 2y ago
But what if it is an app on the phone that is asking for that 2FA which then receives that 2FA via text?

eli 2y ago

OK, so it's a passkey for sites that don't support passkeys. I'm fine with that.