Hacker News Reader

Hacker News

Comment by djha-skin | Hacker News Reader

Full thread

djha-skin

> it distracts me

It would be faster if a password manager is used with browser plug-in.

> It forces me to have a smart phone

Not if we're talking about TOTP. The information for that can be stored in a password manager.

> Or couples online with offline

Not if you use a password manager.

> it can be replaced with other solutions

TOTP + password manager is more convenient (and more online) than yubikey, in my opinion. Especially convenient with a browser plugin.

My chosen pm is KeePassXC, would highly recommend.

One caveat: I hate non-TOTP MFA. It's either proprietary lock-in or less secure.

View on HN

Agree, non-TOPT MFA is a scourge.

It's criminal that Google requires you to set up a phone-based or proprietary MFA before you can switch to TOPT.

Your phone number isn't something you "have" - it's something you're renting from another big company, and their security has obvious reset holes made to cope with unsophisticated users, therefore is worse than a password managers.

The only workaround I've found that is non-distracting is to have a dedicated phone-to-web/email system... Google Voice works for this if you're US based.

I greatly prefer SMS auth(At least for personal stuff, I see the value of TOTP for work) because of exactly those reset holes. For low value targets it's not really much of an issue, and makes it much harder to get locked out of your account, which would be almost as much of a problem as getting hacked.

> One caveat: I hate non-TOTP MFA. It's either proprietary lock-in or less secure.

Agreed. A particular pain point for me is Apple's proprietary (or SMS-based, even worse) iCloud 2FA, it's just awful. I would use TOTP/HOTP for it in a heartbeat if given the option.

They support standard hardware keys now, which have worked pretty well for me. Just can’t use them if you have devices which aren’t on one of the later OS updates since the OS won’t support signing in with a yubikey.

> TOTP + password manager is more convenient (and more online) than yubikey, in my opinion. Especially convenient with a browser plugin.

More convenient than yubikey webauthn, or just yubikey TOTP? Personally I find tapping my yubikey much easier than any 'enter the code' 2FA.

Also it should be noted that storing your TOTP secret in the same place as your password means you're one malware attack away from losing access to that account. While this risk may be acceptable for many accounts, it should at least be considered.

The security implications are indeed a debate, but really any attack on the password manager is a huge security problem anyway so you might as well store the TOTP information there. One way to mitigate this is to use offline password managers such as keepassXC (which I use) and non-proprietary sync stuff such as syncthing (but I just use a cloud drive provider).

Entering a code is easy because of the password manager plug in. I don't have to find the Key with my finger, I just have to click with the mouse. Much easier.

If your password manager is hacked, but your TOTP info is offline, how is this not better that having TOTP info in your password manager? Also not sure how syncing through a cloud drive is any better than a cloud password manager.

> Also not sure how syncing through a cloud drive is any better than a cloud password manager.

The private keys stay on your machine

Not if you're using a commercial cloud drive

Your point about separating TOTP being more secure is a good one and I acknowledge it. I simply find storing the TOTP together with the password manager to be a reasonable compromise between security and convenience.

Sinking through a cloud drive is better because it diffuses the value proposition of hacking the cloud drive. If someone hacks The cloud provider they are likely to find a bunch of ripped videos and pictures of children and cats, with the occasional sensitive file here and there. Thus it makes less sense as a hacking target while still having lots of the same protections and professional oversight as any other cloud provider.

The value proposition of hacking a password manager SaaS is much higher so it becomes much more worth someone's time to hit.

It's like the difference between storing gold in a lock box in a bank and storing gold in a lockbox in a storage rental facility. Storage rental still has guards and locks and cameras, but will not attract the attention of dedicated, organize efforts to extract value like the bank will.

Good points. I keep Auth backups in my pw manager for convenience also, just because I don't know of a better way other than printing the qr code and stuffing in my desk.

I'm not worried about a general cloud beach as much as I am a personal attack if someone gets hold of my phone and manages to unlock it. Then they have 2 of the 3 keys: the cloud drive, and the Auth app. All they need to do is hack the pw manager, which if they have the vault file from the cloud drive, they can brute force until the cows come home.

Did the one you hate include Duo? That’s the only one I’m using that is not TOTP based. But eventually I find a way to get the secret and generate the 2-factor myself.

I agree with you about using a password manager to solve these kind of problems. One thing people don’t understand is we have collaborators that need to deploy to a Chile desert where the environment is so bad that your mobile phone would likely die there. (It’s not recommended to bring one anyway.) So all these solutions requiring a 2nd device, usually a mobile phone, is very annoying. The most annoying part is that these security policy is enforced by central university who don’t care about the requirements of a research project.

But frankly, even if there’s a way to do it with a password manager (using site computing for example so no mobile is necessary), this is not presented as the way to use MFA, and some would consider it a breach of security.

Unfortunately, in my experience, there is lots of MFA out there that doesn't support TOTP (many providers probably don't even know it exists).

IMO you don't have MFA if your codes are generated by your password manager.

Does someone who has phone-based MFA and a phone-based password manager lack MFA?

Does it matter if they're in the same app?

Yes, very much, you can have different passwords on the two separate applications.

This is also reductive because it doesn't take into account password managers used on a non-mobile device, where the benefits become obvious in that if one of your devices is comprised it's unlikely that the other is too.

> Does someone who has phone-based MFA and a phone-based password manager lack MFA?

Yes. Call that say 1.25 factors. It is of greater than zero value.

1Password covered this very well:

https://blog.1password.com/1password-2fa-passwords-codes-tog...

They tackled the subject for sure, but my takeaway from that blog posting is not that storing your TOTP tokens in 1Password is “as good as” having separate hardware devices for password storage management and TOTP management, but rather that storing your TOTP tokens in 1Password (or any password manager) is better than not using OTP at all. This of course is definitely true, and a definite improvement in security. I think a sibling referred to it as “1,25x” as secure, which feels about right (on some non-linear scale where 2.0 represents two unique factors).

I don’t use a KeePass or similar device, and I do have my TOTP tokens on my phone (using the great OTP Auth app, no affiliation), but I do most of my work on a computer so I toyed with completely removing password management from my phone and just having the OTP app there. I haven’t committed to that that yet though. Another option is to use a cheap device such as an iPod Touch for OTP, though those are probably more expensive than a dedicated OTP device (I just happen to have one lying around unused).

WebAuthn is more secure, easier to use, and is not proprietary.

without a browser plugin or something better than human eyes to verify domain matches, password + totp are phishable / mitm-able in an online attack

A fact that becomes important in some contexts. Nevertheless I still feel it is the best compromise between convenience and security available to us.

Reply on news.ycombinator.com