Hacker News Reader

Comment by arepublicadoceu | Hacker News Reader

I would argue that the most important account to have TOTP enabled IS your password manager. So, if you already have a TOTP app to generate codes for your Password Manager why not consolidate it?

Besides, if you dont have a physical and digital backup of your TOTP seeds you really like to live dangerously.

View on HN

The one place I intentionally don't have TOTP is my password manager.

there is a base case somewhere in a backup strategy where TOTP is not feasible. The base case for me is "Keepass file backed up to multiple locations and my master key written down in an envelope in my house in case I hit my head".

Why would I lock my passwords away behind a TOTP that can get lost? My TOTP in Authy is protected by a long random key. Where do I store the key? In my password manager.

You can't use a password manager and TOTP to back each other up.

I realise now that I was not clear on my post. Using TOTP or second factor is useful for those heathens that insist in using cloud based service for password manager (I'm one). Not for local keepass/pass synced by syncthing/rsync/ssh etc.

I treat my kdbx as a single password encrypted backup of my bitwarden vault on my computer and external hard-drive.

I care much less about second factor if it's something offline on my computer than something accessible by a web interface to anyone in the world.

Well my password manager don't have an account to begin with, neither does my TOTP manager. And depending on risk assesment for a given site/account, letting the password manager do some doubble duty as TOTP manager as a convinience is fine, especially if the alternetive outcome would be to not enable TOTP due to the annoyance.

2fa for your password manager is good, but that doesn't have to be TOTP. That can just as well be something like the 1password secret key (something you have).

I think that's the idea behind using a key file and a password in KeepassXC.

Reply on news.ycombinator.com