4 ms·

I see everyone putting their TOTP and second factor in the same vault as their username/password. Doesn't this defeat the purpose of the second factor to some d

I see everyone putting their TOTP and second factor in the same vault as their username/password. Doesn't this defeat the purpose of the second factor to some degree?

larsnystrom 1y ago
Sure, but TOTP still defends against password leakage. So it’s still more secure than only using a password.
immibis 1y ago
It's about accountability sinks. The purpose of requiring the second factor is for the company to blame the user when the user gets hacked. It has very little to do with actual security.
nabeards 1y ago
Agreed Stefan! I keep mine in separate vaults for this purpose. I’m still not on board with passkeys yet, but the discussion here makes BitWarden seem like the best solution.
augustl 1y ago
With TOTP you have a private key that you don't transmit over the wire, as opposed to your password, so security is improved even though the password and TOTP is in the same vault.
jeroenhd 1y ago
It definitely does. But many people don't want to use actual 2FA, or they don't understand the point behind it. As long as their vault is properly secured (with actual MFA) that shouldn't be too much of a risk, until they get hit with a virus, of course.
felixfoertsch 1y ago
To me, this totally depends on your threat model. Generally, a one-time password is an additional security measure that prevents someone from going to a website and simply using obtained credentials (eg from a leak) or brute-forcing them. An attacker needs the second factor. If you store your 2FA secret alongside your password in a password manager, you still gain protection from these attacks. And it's very convenient. However, you also increase your attack surface: if they break into your password manager, your done. If your threat model allows it (mine does), this is still very secure and also very convenient.
- ellisv 1y ago
  Exactly. The greatest risk to the average person is their credentials are obtained through a leak and 2FA helps mitigate that impact. I know many people who still reuse passwords, which certainly have been leaked, and are probably protected only by 2FA.
johanyc 1y ago
Yes it’s then two step verification not two factor, a bit less secure but a lot more convenient (age old trade off between the two). The benefit you get compared to having only password is that it’s now time based instead of static.

I see everyone putting their TOTP and second factor in the same vault as their username/password. Doesn't this defeat the purpose of the second factor to some degree?

larsnystrom 1y ago

Sure, but TOTP still defends against password leakage. So it’s still more secure than only using a password.

immibis 1y ago

It's about accountability sinks. The purpose of requiring the second factor is for the company to blame the user when the user gets hacked. It has very little to do with actual security.

nabeards 1y ago

Agreed Stefan! I keep mine in separate vaults for this purpose. I’m still not on board with passkeys yet, but the discussion here makes BitWarden seem like the best solution.

augustl 1y ago

With TOTP you have a private key that you don't transmit over the wire, as opposed to your password, so security is improved even though the password and TOTP is in the same vault.

jeroenhd 1y ago

It definitely does. But many people don't want to use actual 2FA, or they don't understand the point behind it. As long as their vault is properly secured (with actual MFA) that shouldn't be too much of a risk, until they get hit with a virus, of course.

felixfoertsch 1y ago

To me, this totally depends on your threat model. Generally, a one-time password is an additional security measure that prevents someone from going to a website and simply using obtained credentials (eg from a leak) or brute-forcing them. An attacker needs the second factor. If you store your 2FA secret alongside your password in a password manager, you still gain protection from these attacks. And it's very convenient. However, you also increase your attack surface: if they break into your password manager, your done. If your threat model allows it (mine does), this is still very secure and also very convenient.

ellisv 1y ago
Exactly. The greatest risk to the average person is their credentials are obtained through a leak and 2FA helps mitigate that impact. I know many people who still reuse passwords, which certainly have been leaked, and are probably protected only by 2FA.

johanyc 1y ago

Yes it’s then two step verification not two factor, a bit less secure but a lot more convenient (age old trade off between the two). The benefit you get compared to having only password is that it’s now time based instead of static.