3 ms·

Multifactor Authentication is having at least two of the following: * Something you know (such as a password) * Something you have (security key, TOTP generat

Multifactor Authentication is having at least two of the following: * Something you know (such as a password) * Something you have (security key, TOTP generator) * Someone you are (biometrics, fingerprint/face id) * Somewhere you are (network or geolocation) Using a password manager app and TOTP generator app on the same phone is clearly a single point of failure and does not add meaningfully to your security compared to just storing the TOTP in the password manager. If your device is compromised the attacker has control of both apps potentially, and very likely the TOTP app does not require an additional password or factor. And unless you use a FIDO2 device for MFA, TOTP is not phishing resistant. You can mitigate these issues though. However, if you require a specific device to access the password manager by one of the following methods: * Offline password manager such as KeepassXC (needing the password database file) * Needing a keyfile (like with KeepassXC or 1Password’s device key) * Needing to be on a specific network such as VPN (when using a self-hosted password manager like Bitwarden and configuring the firewall to be limited to a wireguard network for example) Does this count as an additional possession factor or location factor? And if it counts as a possession factor does it meaningfully increase your security posture to have multiple possession factors beyond a FIDO2 key?

jorvi 2y ago
> Using a password manager app and TOTP generator app on the same phone is clearly a single point of failure and does not add meaningfully to your security compared to just storing the TOTP in the password manager. You are so wrong. You can log into a password manager from the browser. Now you’re completely pwned. Let’s compare it to separated 2FA: they pwn my 1Password, but then how the hell are they going to log into my 2FA app? They’d need to breach the 2FA on my Apple/Google account and then again on my Authy, which in practice will mean either a SIM swap or SS7 attack. Only adept threat actors have access to those techniques. If you just have a pedestrian threat model, store your unimportant 2FA in your password manager, and the really important one’s in a separate 2FA app (2FAS or Authy). 1Password is naturally 2FA by way of its Secret Key system. Boom. Simple and secure.
- kemotep 2y ago
  > You can log into a password manager from the browser. Now you’re completely pwned. Can you elaborate here? My point was that your phone is a single point of failure if you use it primarily for both your 1password account and your TOTP generator. Compromising the phone gives you access to both apps. And I mention that this can still be mitigated. One of those ways is through adding a password or biometric unlock to your TOTP generator app (as you point out). Or you use a second device like a yubikey. But the point of that paragraph is that combining passwords and totp codes into your password manager is a single point of failure. Separating the passwords and totp but still using just 1 device, can also be a single point of failure.
  - jorvi 2y ago
    >> You can log into a password manager from the browser. Now you’re completely pwned. > Can you elaborate here? Your point is that if you have both a password manager and a 2FA app, it is functionally as insecure as just having a password manager with integrator 2FA storage. I pointed out how that is worlds apart. If you store your passwords and TOTP together in a password manager, and someone breaches it by say, shoulder peeping, they can just login via the web and now they have full access. In the case of a separate 2FA app, no such luck for them. They can log in to your password manager, but since they don't have access to your TOTPs, they can't login anywhere (or anywhere important, if you do what I do). This means they can't breach your Apple/Google account or 2FA either. > Separating the passwords and totp but still using just 1 device, can also be a single point of failure. But if someone compromises your phone, they are already physically close. At that point can also just yoink your Yubikey out of your bag or pocket, both within less then a meter of your phone :) In general, theorizing about evil maid attacks is useless because any sufficiently motivated threat actor with access to you and your stuff will breach no matter what, and your unfriendly neighborhood hacker will not have sufficient motivation and/or tech to breach you. If you mean that as: if your drop your phone in a lake on vacation you're SoL.. well, keep a sheet of backup codes printed and hidden or in a vault and bring it with you on vacation. The backup codes aren't enough for any opportunistic thief, as they'd still need your password and/or access to your e-mail.

jorvi 2y ago

> Using a password manager app and TOTP generator app on the same phone is clearly a single point of failure and does not add meaningfully to your security compared to just storing the TOTP in the password manager. You are so wrong. You can log into a password manager from the browser. Now you’re completely pwned. Let’s compare it to separated 2FA: they pwn my 1Password, but then how the hell are they going to log into my 2FA app? They’d need to breach the 2FA on my Apple/Google account and then again on my Authy, which in practice will mean either a SIM swap or SS7 attack. Only adept threat actors have access to those techniques. If you just have a pedestrian threat model, store your unimportant 2FA in your password manager, and the really important one’s in a separate 2FA app (2FAS or Authy). 1Password is naturally 2FA by way of its Secret Key system. Boom. Simple and secure.

kemotep 2y ago
> You can log into a password manager from the browser. Now you’re completely pwned. Can you elaborate here? My point was that your phone is a single point of failure if you use it primarily for both your 1password account and your TOTP generator. Compromising the phone gives you access to both apps. And I mention that this can still be mitigated. One of those ways is through adding a password or biometric unlock to your TOTP generator app (as you point out). Or you use a second device like a yubikey. But the point of that paragraph is that combining passwords and totp codes into your password manager is a single point of failure. Separating the passwords and totp but still using just 1 device, can also be a single point of failure.
- jorvi 2y ago
  >> You can log into a password manager from the browser. Now you’re completely pwned. > Can you elaborate here? Your point is that if you have both a password manager and a 2FA app, it is functionally as insecure as just having a password manager with integrator 2FA storage. I pointed out how that is worlds apart. If you store your passwords and TOTP together in a password manager, and someone breaches it by say, shoulder peeping, they can just login via the web and now they have full access. In the case of a separate 2FA app, no such luck for them. They can log in to your password manager, but since they don't have access to your TOTPs, they can't login anywhere (or anywhere important, if you do what I do). This means they can't breach your Apple/Google account or 2FA either. > Separating the passwords and totp but still using just 1 device, can also be a single point of failure. But if someone compromises your phone, they are already physically close. At that point can also just yoink your Yubikey out of your bag or pocket, both within less then a meter of your phone :) In general, theorizing about evil maid attacks is useless because any sufficiently motivated threat actor with access to you and your stuff will breach no matter what, and your unfriendly neighborhood hacker will not have sufficient motivation and/or tech to breach you. If you mean that as: if your drop your phone in a lake on vacation you're SoL.. well, keep a sheet of backup codes printed and hidden or in a vault and bring it with you on vacation. The backup codes aren't enough for any opportunistic thief, as they'd still need your password and/or access to your e-mail.