Hacker News Reader

But MFA is there to prevent this compromise from affecting the service and alert users/admins to the compromise, right?

If you have username and password and are able to force the TOTP in the 60s window, the TOTP would be useless imho.

If a user keeps their credentials in a notebook and it got stolen, the TOTP check can be the difference between the attacker getting in, and the user being notified and changing their password

Unfortunately these days it’s even easier with password managers containing all three (user, pass, token)

The difference being the notebook is paper and easily read, while the password manager is... quite a bit harder.

I want to believe users who use a password manager are also technically literate enough to secure it properly

Me too, but my day job means I handle a bit of secops, password managers are rolled out as security tools to users operating in enterprises where things like mandating people don't keep their passwords on a sticky note on their monitor is usually step one...

Oh wag doesnt use username and password auth by default. Those are only available in the OIDC integration or if you use PAM auth.