8 ms·
But if you store everything in the password manager, it's no longer two factor.
by davidt84 2y ago
But if you store everything in the password manager, it's no longer two factor.
- lxgr 2y agoYes, but I don’t need/want 2FA everywhere, and it’s still a strictly better single factor than a password (since WebAuthN is resilient against server-side database leaks and phishing).
- hypeatei 2y agoIt's still two factors regardless of storage. Say you accidentally paste your password into the wrong field and post it on a forum. Whoever gets that still needs the second factor. Sure, if your password vault gets breached then everything is exposed but that's extremely unlikely and you have a lot of work to do in that event regardless. It's an inherent risk to using a password manager: everything is centralized so it's a valuable target.
- davidt84 2y agoIt is not extremely unlikely, all it takes is for you to unlock your password database on a device with some malware. The point of a second separate factor is to reduce that risk.
- duckmysick 2y agoIf there's malware on my device, isn't it game over already? Even if I have a second factor elsewhere, the malware can access session keys to whatever service I logged into from that device, among other things.
- davidt84 2y agoIt's certainly not good, but if you require 2FA to, say, change the email address attached to your account, or make withdrawals, or other important actions, it's not game over.
- Matumio 2y agoIn theory. But if everything is in the password safe, the malware can just grab that and upload? And cover its traces. As opposed to patching every application/service you might use, and get access only when you use it.