Hacker News Reader

Comment by Ajedi32 | Hacker News Reader

But wouldn't it be even more convenient to just not use 2FA in the first place? If you're just going to store your TOTP seed in the same place you store your password, why even bother?

View on HN

If a crappy website’s user database gets attacked, the hacker may have my plaintext password stored in it. They may not have my 2FA seed, so there’s at least a chance that the attacker still may not be able to access my account.

I think this is much more likely than an attacker cracking my 1Password vault.

Your point is true, but it is highly unlikely that a website providing 2FA would also be storing passwords in plaintext.

Wouldn't the TOTP seed be stored in the same breached database? Where else would they store it?

In my case, I actually enable 2FA mostly for convenience, rather than security. I often log in from different country IPs (VPN), I auto delete cookies, often use private mode, etc., so some websites are frequently suspicious about my login and ask me for an additional step to verify, e.g. by asking an additional question or sending an email with a verification code. There is usually no way to manually disable this additional check; nor do websites seem to learn that logging in from different IPs with no cookies is my usual behavior. Enabling 2FA makes websites have more trust in my login, so I get none of those additional verifications, with no additional inconvenience as 2FA stored in password manager and typed automatically just like the password. So in a way I enable 2FA in order to disable 2FA.

I would think 2FA-in-masterdb still protects you against some website hacks, most browser exploits and phishing sites, using your password on other potentially compromised devices (public wi-fi, work, etc.) and probably some keylogger scenarios that would miss the database content.

It seems your threat model just doesn't match mine, and I'm glad you have the emotional energy to pull out your phone to auth to every website. Yes, sure, if some rando joker exfiltrates my 1P vault and keyloggers my machine, fine, they get all the things for all the things, but that's Security Darwinism at work if I allow that to happen

Reply on news.ycombinator.com