2fa – A two-factor authentication agent | Hacker News Reader

2fa – A two-factor authentication agent

rsc.io

32 pointsstablemap15 comments

Genuine question: To what extent is it a second factor if you e.g. have both your password manager and your TOTP secrets on the same device?

If it is a mobile device the chances that a remote access trojan can access TOTP codes are low. iOS and Android have better security model compares to desktops. This includes device encryption, password or similar by default and sandboxing.

In no sense at all is it a second factor in that case.

I use 1Password for 2FA, but this is pretty awesome!

Why do you bother? If 1Password is generating your passwords, you're getting virtually no additional security from TOTP by having 1Password manage your TOTP secrets.

You actually do get additional security. A password (in my view) is disposable. I already assume that every site that I have an account for has been compromised so the passwords 1Password is managing are burner passwords.

In order to get access to my account you'd need to know my 1Password master password (which is only in my head) in order to access anything that requires MFA/2FA. If someone hacks Amazon, Coinbase, Twitter, Dropbox, Google, or any other place and somehow figures out my password, they still can't log into my accounts.

Now in the case that one of those services gets hacked and they get access to more than user credentials e.g. all of the data/metadata; Then you're right, having MFA/2FA is useless.

  - Password is for them
  - TOTP is for me

If your password manager is your 2fa is that still 2fa?

If the attacker got access to your 1Password account, then yes, you're screwed.

However, if your password was stolen from a breached site (or something of the like), your 2fa token, even from 1Password, would still be a second factor.

They've already owned up the site. They've got your password and all the TOTP secrets, for whatever that's worth. It's a 1Password password. The whole point is that the password only works on that one site. What's been gained here?

If you're using 1Password, and you're considering having 1Password manage your TOTP secrets, just skip TOTP. Turn up the complexity on your passwords if that makes you feel better.

True, but there are many other ways people can lose control of their password other than the site being owned and TOTP helps in most of them, right? PW phished, shoulder surfed, socially engineered, etc.. I agree that separate devices is better, but given the choice of no 2FA and storing both secrets in 1PW, it still seems to me like you're better off with the latter. Happy to be corrected if I'm wrong on that.

If there is a security benefit to enabling TOTP and then storing the secret in 1Password alongside your 1Password-generated password for that site, it is extremely marginal.

I don't think TOTP is dumb; I think you should use it, but only let the keys touch your phone, never your computer.

Can I ask for clarification? If I'm managing passwords with 1Password on both my Android phone and my Windows desktop, how can I effectively use my TOTPs as a second factor?

Is it enough to run the TOTPs through the Google Authenticator on my phone (alongside 1Password on the same device)? I'm unclear on what kind of separation is "useful" separation and looking for the "right" way to set this up.

That's why I'm decoupled (to an extent). You can have access to my lastpass account, but that won't get you into any of my 2fa-protected accounts of which lastpass is one.

Is the expectation that the site storing your password is storing your password insecurely but the 2fa symmetric key securely?

On this topic, shout-out to ykman oath (if you have a YubiKey).

Reply on news.ycombinator.com