Hacker News Reader

Comment by hcurtiss | Hacker News Reader

How are you populating non-SMS 2FA codes automatically?

1Password can do this for you, and I assume many other password managers as well.

https://support.1password.com/one-time-passwords/

I use 1password but opt out of this feature. Just as described in the article masterpassword creates a single source of failure so I don't personally want to put more eggs in that basket.

I keep my unimportant 2FA in 1Password and the really important one’s (e-mail, domains, etc) in a separate 2FA app.

If someone has pwned my 1Password I don’t really care if they log on to my Discord or order a limited amount of crap on Amazon because I am in much deeper shit at that point.

It depends on the set of credentials. Your primary email address, your access to 1Password, things of that nature can and should be stored in a 2FA app on another device. But the majority of 2FA codes for most websites are fine to be stored in your password manager. This way you can enable 2FA on every site you use, without the inconvenience, but you can reserve the extra security of a second device for services that would be critical failure points for you.

Apple hardware can auto-fill 2FA codes if the codes are set up in the Passwords tool on iOS/iPadOS/macOS, which are synchronized through iCloud.

If you use BitWarden paid version ($10/yr) then after an autofill of username/password, the totp is automatically added to the clipboard.

iOS’s built in password manager iCloud Keychain does this automatically (at least on Safari).

KeepassXC can act as a TOTP client and can fill it just like it can do passwords.

That, I don’t, but I only have those on work accounts anyway. None of my work stuff is set up to be as nice as my personal stuff, but that’s mostly outside my control.

Oh, wait: Steam has them I guess. Every so often (once every few months?) I have to type in one of their codes.

I did just check and I guess I could be doing this with non-sms codes if I added them to my password manager. If I had more than just Steam that used them, I’d do that.

Reply on news.ycombinator.com