Hacker News Reader

Comment by polyvisual | Hacker News Reader

I use Authy. I've read a few comments about how migrating away is difficult. What do you use instead?

I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

> I also use bitwarden, but not sure how I feel about passwords and totp being in the same app.

I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure?

If someone gets access to your unlocked PC/phone, don't they then have access to both? Do you store your TOTP vault password in your password vault (obvious)?

If someone gets into your password vault, why wouldn't the same mechanism also let them get into your TOTP vault? (This applies whether it's brute force, keylogger, hardware exploit, or $5 wrench.)

>In what cases would your password vault be compromised, but your TOTP vault still be secure?

If the password vault is on one device and the TOTP app on another then it would be harder for an attacker to get into both.

I have the same concerns about passkeys. How is it secure if the only thing an attacker needs is a single method of accessing a single device?

Generally the threat model that TOTP protects against is not someone breaking into your device. The threat model that it protects against is someone compromising your other credentials. So, although not recommended, you could post your login credentials on twitter and still nobody would be able to get into your account. An attacker hacking into your laptop/desktop/phone with access to install keyloggers and hijack connections is not really what it protects against.

>Generally the threat model that TOTP protects against is not someone breaking into your device.

And yet, in some realistic scenarios TOTP does protect me against that, if the second factor is on a different device, kind of like a poor man's yubikey.

Not if I'm on your device and hijacking your already-authenticated connection. I just need to be careful enough to do it in the background in such a way that you don't notice.

If my device got stolen I would remove the device from my accounts immediately. And without the second factor you wouldn't be able to do anything about it.

The threat is that your device is infiltrated right now.

In a corporate setup, it also somewhat protects against intentional policy-violating password sharing between employees.

> How is it secure if the only thing an attacker needs is a single method of accessing a single device?

You should have two-factor for your password vault as well, and that TOTP is stored on a separate device.

In other words, you replace the model of having password+TOTP for every account, to having one password+TOTP for your password vault, and effectively treat that password vault as an authentication service for yourself.

That's a good idea.

Now I just have to find out how to configure this for passkeys.

> I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure?

If Bitwarden is compromised, like LastPass was. Of course the vault should still be encrypted, but I don't want to rely on a single company managing everything correctly. It seems much less likely that two different companies will be compromised at the same time.

that's been my attitude, both are keyed to my face id, otherwise encrypted. my phone times out really quickly if i'm not typing away on it. I feel relatively safe. I wonder though how much longer they will maintain the phone apps. All my desktop versions are verified from my phone, so them dropping the desktop sucks but isn't catastrophic.

I use iCloud Keychain because I use a Mac, iPad, and iPhone.

I use Authy with Face ID protecting the entire app on my phone. I don't use the Desktop app because it won't use Touch ID, meaning I have to type in a long master password.

I don't see an attack as likely to happen (I own no Bitcoin, not a billionaire, not in charge of anyone else's secrets) but if there was a flaw that let somebody access the passwords on my Mac or iPhone, they'd still need the 2FA codes from my phone. I think that's more likely to happen on the Mac because I do have apps downloaded from somewhere else besides Apple's App Store.

My guess is that most of the people who worked on Authy have fallen by the wayside after the Twilio acquisition. It's annoying every time I have to search the boxes on my phone or the list on my watch: can't we please have alphabetization?

> I guess this depends on your threat model. In what cases would your password vault be compromised, but your TOTP vault still be secure?

Key logger?

I unlock my password vault frequently. I only unlock my TOTP vault to:

1. Add a new secret 2. Recover access to an account if my authenticator has died.

Since I unlock my TOTP vault so infrequently, the number of hashing rounds/etc are tuned to be _much_ slower and require _much_ more memory. It uses an entirely separate set of credentials from my main vault. And you're unlikely to snag the password unless you're watching me for a long time or get very lucky.

ahhhhhhhhhhh!

Wow, this might be the answer to a question that's been bugging me for a while!

It didn't seem right to keep all of my TOTP secrets isolated on one easily lost/stolen/broken device (phone), so when I realized KeePass supported generating TOTP codes I moved all my TOTP secrets into my password database (which is synced around all my devices) then deleted the single-purpose authenticator app as unnecessary.

But then it didn't seem right to have all of my TOTP secrets live in my normal vault with my credentials since that loses the "second factor". Nor did it seem like it would help to make a separate database for TOTP secrets and sync it around too - still no second factor, plus added friction to open both databases on every login.

But as you say, I could keep TOTP secrets in two places - in an authenticator app on my phone with no syncing for daily use (keeps the two-factorness cause it's on a single device, and is low friction cause it piggybacks on the security of my phone and doesn't require a separate login) AND in a TOTP specific password database that's synced around but opened only rarely (in the cases you described).

Thanks for the hint about tuning hashing rounds; didn't know that could be configurable! Looks like KeePass supports that too; I'll look into that.

I had the same problem and didn't want to keep all of my eggs in the same basket, plus I lost faith in these backup apps after Google Auth lost user codes at some point.

I decided to create a private backup which I control and so I built a client-side web app that encrypts QR codes (like 2FA codes). It was inspired by a similar CLI based project I saw here on HN. I still use Authy (for now) but now I have encrypted images that I can decrypt and rescan easily. And since they're just images I saved them in various places and even printed out copies should I lose my phone or Authy access.

To 'migrate' my codes out of Authy I just went through each site and regenerated the codes (plus encrypted them). It's annoying that they force you to do this but doesn't take too long.

I'm still polishing it up but it works well and I would love some feedback if there's anyone who finds it useful - https://encrypt-qr-codes.netlify.app/

> not sure how I feel about passwords and totp being in the same app

I felt the same way and I've come to realize that it is not a big deal. One advantage is that with a shared password manager account, you can also share the TOTP along with it. Very convenient for a bunch of usecases.

Is it really multifactor then, with everything in Bitwarden?

The way I see it, your password manager becomes the central point of failure. Therefore, secure your password manager with a hardware security key (yubi). Not all accounts stored in a password manager are created equal... some need more security than others. If there are accounts that you want additional 2FA security on, just use a separate TOTP app. It doesn't have to be an all or none option.

The second factor is not meant or designed to safe you against a compromised PC or phone (your session or cookies could be probably more easily stolen even when second factor on another device). Many people have passwords and totp on the same phone too. The second factor is more meant to verify that you are really you to a web site and safeguard your account on that web site.

Aegis & KeepassXC. KeepassXC could do it all alone and seperate TOTPs under a seperate database secured to a different password if you please.

I've moved over to Proton Pass (you can do TOTP on the desktop through a browser, I figured if I'm authenticating into a site I must have internet) but KeepassXC was a strong contender. Both have excellent mobile support and Keepass has native desktop clients.

Proton Pass isn't free, though, but I already had their services.

Happy to hear you've switched to our password manager! Just to clarify, you can use Proton Pass for free too: https://proton.me/pass/free.

I use Bitwarden, but have moved as many 2FA/MFA accounts to Passkeys as possible to avoid needing MFA.

It does feel bad, but your password manager is already protected by MFA, right?

It does mean you're putting a lot of trust in your password manager, but on the other had, you already kind of were, weren't you?

I use Raivo for TOTP on iOS. It is open source and makes it easy to migrate to another app

I used to use it, but the author refuses to publish a desktop app. I actually was able to install the iOS app on my desktop, but if I ever remove it, it is gone forever because he revoked it from the appstore. He only wants you to use the desktop receiver.

It is also buggy af and doesn't sync properly. He's pretty much not doing any more updates of the app either.

That experience pushed me off it forever.

Edit: The app has been acquired by a third party. I'd move off it.

https://www.reddit.com/r/privacy/comments/158ihxd/raivo_auth...

Reply on news.ycombinator.com