4 ms·

Just consider that storing TOTP codes in the password manager negates the advantage of two factors authentication, namely the added security of needing a second

Just consider that storing TOTP codes in the password manager negates the advantage of two factors authentication, namely the added security of needing a second device. This would keep your logins safe even if somebody managed to breach your KeePassXC database.

wolvesechoes 1y ago
You are allowed to have two separate databases, with different passwords. You can even store them on different devices!
- speedgoose 1y ago
  It’s still one device.
  - quchen 1y ago
    The second factor does not have to be a second device. Like everything security, it’s what you’re protecting against. Shoulder surfing and device theft are not something I worry about in my home setup, for example.
    - speedgoose 1y ago
      Yes it depends on your treat model. But being defeated by one simple keylogger isn’t a risk I’m willing to take even at home.
      - AstralStorm 1y ago
        And yes, 2FA single use codes will protect against a simple keylogger. But if its on the same device, it will not protect you against a password database harvester.
    - Aachen 1y ago
      > The second factor does not have to be a second device. Like everything security, it’s what you’re protecting against. It doesn't matter if you store your 2FA seed on a billboard or as a tattoo where the sun doesn't shine: 2FA means two factors. The definition doesn't change when your home setup's threat model doesn't call for 2FA and you thus decide to store two secrets in the same place (making a compromise of one necessarily a compromise of the other, thus 1FA)
      - wolvesechoes 1y ago
        > making a compromise of one necessarily a compromise of the other, thus 1FA The only necessity is logical necessity, and it doesn't apply there.
        Aachen 1y ago
        You're saying you can store two pieces of information in one file, without a compromise of one implying a compromise of the other? Do elaborate
        wolvesechoes 1y ago
        GP stated: > The second factor does not have to be a second device. Now, you are talking about two pieces of information in single file.
      - brookst 1y ago
        This is so wrong. You’re conflating where things are with what they are. Two factors does not mean two devices.
  - alanfranz 1y ago
    If you login from your phone, it’s still one device. Should we have different totps for different devices? Something that you have can be your own pc.
    - Aachen 1y ago
      You're onto something even banks don't seem to understand! The industry standard for doing financial transactions calls for 2FA but then they make a mobile app that can self-approve transactions. Yes, using only one mobile device is 1FA, just like using one desktop only, but people generally consider mobile OSes safer because the permission model and process isolation is on a whole other level
      - broken-kebab 1y ago
        There's a grain of truth in your statement, but no matter how hard it's to accept for all of us nerds here, in real life words are defined by usage. If industry calls it 2FA, users call it 2FA, then it's 2FA.
        Aachen 1y ago
        They can call the sky green but unless the wavelength changed, I don't see the benefit of taking over that terminology, no matter if you're a user or a nerd or both. That's the real-life situation: sky isn't green, idk why anyone would need to "accept" that or not when it factually isn't the case
        broken-kebab 1y ago
        Your choice of example is somewhat self-defeating: blue-green is probably the best illustration of terms with big semantic overlap even in languages which care to have separate words for these colors (there are those which has one word for both). Generally, meaning of words defined by informal convention of majority. You are free to disagree with it, but it only means you will speak your own dialect always in need to explain yourself to everybody who's not you.
  - wolvesechoes 1y ago
    If you store two databases on two devices it makes them suddenly one device? What kind of security sorcery is this?
StrLght 1y ago
> negates the advantage of two factors authentication Like with all things it depends on your threat model. If your threat model includes risk of leaking all data from your password manager – then yeah, it worsens your security. Otherwise it still covers all other risks: 1. it makes bruteforce basically impossible 2. it makes phishing harder (assuming that your password manager supports autofill and that it checks domains correctly) 3. it lowers the risks if a single password leaks
- Aachen 1y ago
  All of this is true without 2FA, just storing securely generated passwords in the manager. Whether it negates the benefits of 2FA (i.e. whether it's 1FA) doesn't depend on the threat model. The threat model is what makes an individual decide whether 2FA is worth it
  - brnt 1y ago
    No? Without TOTP in Keepass, an attacker still only requires a password (which may be brute forced or otherwise obtained from badly secured websites). If you have TOTP, they _also_ need a copy of your keepass-file, the password and any other factor to _it_, or have access to your machine during a session or so.
    - Aachen 1y ago
      Think about how the attacker gets there: - "an attacker still only requires a password (which may be brute forced" Brute force? Then it wasn't generated securely. Use Keepass' built-in generator or another one that is meant to generate passwords with. You could make the same argument for the 2FA seed: that can also be generated insecurely or set manually by hand - "or otherwise obtained from badly secured websites" The attackers can obtain the 2FA seed in the same way. Furthermore, the 2FA seed is stored plaintext in the website's database whereas the password is typically stored in hashed form (which is unbruteforceable if you generated it securely) - "they _also_ need a copy of your keepass-file, the [main] password" The attacker either got the website's password from this same file (so they evidently have that file and the main password to unlock it), or if you imagine a scenario where the site got hacked and the stupid site stored your password in plain text, then they have access to the site (and the 2FA seed) anyway because they hacked it. So long as you don't re-use passwords (don't need 2FA for that, just a password manager), a site's breach has no impact beyond this one site that was hacked outside of your control - "and any other factor to _it_" Do you mean the key file here? Or what other factor? Either way, again: if they need that to open the vault then they can't get at the passwords either, so what benefit does {2FA when stored inside the password vault} have? I don't know of a scenario where an attacker can get the website's password from the vault, but not the website's 2FA seed, when you store both inside that same (encrypted) file
hypeatei 1y ago
It doesn't negate the advantage of 2FA. There are so many scenarios that don't involve your entire password manager database being leaked in plaintext. In that case, you likely have much more to worry about considering the attacker has a bunch of places to pivot from (account recovery flows, recovery email accounts, etc..)

wolvesechoes 1y ago

You are allowed to have two separate databases, with different passwords. You can even store them on different devices!

speedgoose 1y ago
It’s still one device.
- quchen 1y ago
  The second factor does not have to be a second device. Like everything security, it’s what you’re protecting against. Shoulder surfing and device theft are not something I worry about in my home setup, for example.
  - speedgoose 1y ago
    Yes it depends on your treat model. But being defeated by one simple keylogger isn’t a risk I’m willing to take even at home.
    - AstralStorm 1y ago
      And yes, 2FA single use codes will protect against a simple keylogger. But if its on the same device, it will not protect you against a password database harvester.
  - Aachen 1y ago
    > The second factor does not have to be a second device. Like everything security, it’s what you’re protecting against. It doesn't matter if you store your 2FA seed on a billboard or as a tattoo where the sun doesn't shine: 2FA means two factors. The definition doesn't change when your home setup's threat model doesn't call for 2FA and you thus decide to store two secrets in the same place (making a compromise of one necessarily a compromise of the other, thus 1FA)
    - wolvesechoes 1y ago
      > making a compromise of one necessarily a compromise of the other, thus 1FA The only necessity is logical necessity, and it doesn't apply there.
      - Aachen 1y ago
        You're saying you can store two pieces of information in one file, without a compromise of one implying a compromise of the other? Do elaborate
        wolvesechoes 1y ago
        GP stated: > The second factor does not have to be a second device. Now, you are talking about two pieces of information in single file.
    - brookst 1y ago
      This is so wrong. You’re conflating where things are with what they are. Two factors does not mean two devices.
- alanfranz 1y ago
  If you login from your phone, it’s still one device. Should we have different totps for different devices? Something that you have can be your own pc.
  - Aachen 1y ago
    You're onto something even banks don't seem to understand! The industry standard for doing financial transactions calls for 2FA but then they make a mobile app that can self-approve transactions. Yes, using only one mobile device is 1FA, just like using one desktop only, but people generally consider mobile OSes safer because the permission model and process isolation is on a whole other level
    - broken-kebab 1y ago
      There's a grain of truth in your statement, but no matter how hard it's to accept for all of us nerds here, in real life words are defined by usage. If industry calls it 2FA, users call it 2FA, then it's 2FA.
      - Aachen 1y ago
        They can call the sky green but unless the wavelength changed, I don't see the benefit of taking over that terminology, no matter if you're a user or a nerd or both. That's the real-life situation: sky isn't green, idk why anyone would need to "accept" that or not when it factually isn't the case
        broken-kebab 1y ago
        Your choice of example is somewhat self-defeating: blue-green is probably the best illustration of terms with big semantic overlap even in languages which care to have separate words for these colors (there are those which has one word for both). Generally, meaning of words defined by informal convention of majority. You are free to disagree with it, but it only means you will speak your own dialect always in need to explain yourself to everybody who's not you.
- wolvesechoes 1y ago
  If you store two databases on two devices it makes them suddenly one device? What kind of security sorcery is this?

StrLght 1y ago

> negates the advantage of two factors authentication Like with all things it depends on your threat model. If your threat model includes risk of leaking all data from your password manager – then yeah, it worsens your security. Otherwise it still covers all other risks: 1. it makes bruteforce basically impossible 2. it makes phishing harder (assuming that your password manager supports autofill and that it checks domains correctly) 3. it lowers the risks if a single password leaks

Aachen 1y ago
All of this is true without 2FA, just storing securely generated passwords in the manager. Whether it negates the benefits of 2FA (i.e. whether it's 1FA) doesn't depend on the threat model. The threat model is what makes an individual decide whether 2FA is worth it
- brnt 1y ago
  No? Without TOTP in Keepass, an attacker still only requires a password (which may be brute forced or otherwise obtained from badly secured websites). If you have TOTP, they _also_ need a copy of your keepass-file, the password and any other factor to _it_, or have access to your machine during a session or so.
  - Aachen 1y ago
    Think about how the attacker gets there: - "an attacker still only requires a password (which may be brute forced" Brute force? Then it wasn't generated securely. Use Keepass' built-in generator or another one that is meant to generate passwords with. You could make the same argument for the 2FA seed: that can also be generated insecurely or set manually by hand - "or otherwise obtained from badly secured websites" The attackers can obtain the 2FA seed in the same way. Furthermore, the 2FA seed is stored plaintext in the website's database whereas the password is typically stored in hashed form (which is unbruteforceable if you generated it securely) - "they _also_ need a copy of your keepass-file, the [main] password" The attacker either got the website's password from this same file (so they evidently have that file and the main password to unlock it), or if you imagine a scenario where the site got hacked and the stupid site stored your password in plain text, then they have access to the site (and the 2FA seed) anyway because they hacked it. So long as you don't re-use passwords (don't need 2FA for that, just a password manager), a site's breach has no impact beyond this one site that was hacked outside of your control - "and any other factor to _it_" Do you mean the key file here? Or what other factor? Either way, again: if they need that to open the vault then they can't get at the passwords either, so what benefit does {2FA when stored inside the password vault} have? I don't know of a scenario where an attacker can get the website's password from the vault, but not the website's 2FA seed, when you store both inside that same (encrypted) file

hypeatei 1y ago

It doesn't negate the advantage of 2FA. There are so many scenarios that don't involve your entire password manager database being leaked in plaintext. In that case, you likely have much more to worry about considering the attacker has a bunch of places to pivot from (account recovery flows, recovery email accounts, etc..)