8 ms·

Why does storing 2FA codes in your password manager make sense?

107 points by andygrunwald 2y ago

timwis 2y ago
Related: Why is it a good idea to store 2FA tokens in 1Password? https://1password.community/discussion/comment/496555 https://1password.community/discussion/comment/496555
ezfe 2y ago
TLDR: Account security is a balance and saving it in a password manager has more benefits than downsides
bloopernova 2y ago
Because there's a trade-off between security and convenience.
- declan_roberts 2y ago
  Exactly, and is there material difference between OTP in a password manager and a passkey in the password manager?
  - lesuorac 2y ago
    Probably. I would bet there are some systems that accept a passkey in a situation that they don't accept a password.
  - rlk 2y ago
    There are a couple of differences: 1. While a password manager should associate a TOTP seed with a domain and only fill codes on that domain, the codes are still visible to you. A convincing phishing attack might trick you into manually entering a code into a fake page. Passkeys don't allow this. 2. TOTP codes are derived from a seed shared between the client and server, so an attacker who gets read access to the server's database could generate your codes. With passkeys, the server can only validate a signature, not generate them.
    - pwg 2y ago
      > A convincing phishing attack might trick you into manually entering a code into a fake page. Sadly, for a far too large population of users, a convincing phishing attack will be successful, even if the tech. is flashing ten different warnings of "this is a phishing attack page" at the same time. You can't "technology" around human nature for a subset of the population.
Alex-Programs 2y ago
I store 2FA keys in a fingerprint protected Aegis vault on my phone, and I periodically export an encrypted (with a master password I remember) backup that I then email to my parents. I get their argument that 2FA makes phishing more difficult, but I disagree that it's its "primary use", or that the distributed factor is unimportant. I personally wouldn't feel comfortable having all my important accounts behind Bitwarden's single point of failure. 2FA for important accounts mitigates the damage if my Bitwarden is broken into.
gruez 2y ago
>A time-based 2FA (TOTP) is time-sensitive, and a man-in-the-middle or proxy needs to be set up to capture that in real-time Is that supposed to be remotely difficult? It'll take maybe an hour to whip up a script that takes the captured credentials, passes it onto a headless browser to attempt the login, capture the session cookie, and optionally refresh the page regularly to keep the session active.
- bsza 2y ago
  Unless the page gives you a captcha before the TOTP, which it definitely should.
  - gruez 2y ago
    None of my bank accounts use a login captcha. Presumably they mitigate bruteforcing using lockouts or similar. Even if they use captchas, captcha solving services exist that solve for less than a cent per solve. It's not a huge barrier.
  - dns_snek 2y ago
    Modern captchas only deter humans, bots will pass right through.
notorandit 2y ago
You may say I am a dreamer, but I am not the only one! Storing 2FA codes in your password manager is not a good idea at all in case you get it breached. Otherwise it could be a convenient idea. If your password manager gets breached you could also loose control of your 2FA as it can be replaced as well. We need to securely store our 2FA codes, sure. But I would advise not to use the "normal" password manager. I for use have them printed on paper.
cheald 2y ago
I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and, significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quite valuable, but it does nothing to protect you in the event of a password manager compromise. This is not a hypothetical; LastPass has suffered multiple breaches, and the more popular a solution, the more likely there are to be attacks against that solution. By keeping your 2FA separate from your password manager, even if it's still just "something you know", it's something you know in a location that's orthogonal to your passwords. If I yield to convenience and use a 2FA desktop app, then now, instead of just attacking my Bitwarden install, you have to successfully attack my Bitwarden install and my 2FA desktop app install to get access to my accounts, and the combination of password managers * 2FA managers is a substantially larger attack surface and requires a significantly more sophisticated attack to get both pieces. The arguments in the article come down to "well, 2FA mitigates phishing attacks" (true) and "Google Authenticator means you can lose your data easily" (also true). But neither of these is a good argument for why the data should be kept together. It just means "use 2FA", and "use a 2FA manager that lets you directly manage your seeds and keep offsite encrypted backups". If you can't be bothered to do it properly, then 2FA codes in your password manager is certainly better than not using 2FA at all, but that just makes it a less terrible solution, not a good one.
- Al-Khwarizmi 2y ago
  You speak as if 2FA were something that most people use willingly and not just something they put up with because they're forced to.
  - cheald 2y ago
    Which is precisely why it's irresponsible to give people the rope to hang themselves with by supporting 2FA seeds in password managers (much less telling them it's a good idea), IMO. People take the path of least resistance; we know this. It's why, for the longest time, people used one password for everything. People don't like using password managers, either, but we would all agree that it's unacceptably insecure to not use them, because the alternative is "one password used everywhere, maybe with a single varying digit on the end".
throwpoaster 2y ago
I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.
- kubo6472 2y ago
  I'm sorry this happened to you, but it highlights another very important factor. Don't keep all keys to the kingdom on one person. Always divide and conquer. Keep power distributed between multiple people. I worked at a company of 500+ people, and I'm sure the CEO didn't have access to all the IT people's stuff. They only cared that everything works and meet their quarterly goals. Shall the IT person feel like sabotaging stuff, there are distributed backups and mainly the fine print in the work contract preventing that. I know this doesn't necessarily apply to smaller companies and startups, but have lawyers write you strong contracts that aren't one-sided, but are full of protections for both sides, if they aren't sabotaging stuff.
  - throwpoaster 2y ago
    This, yes, but there’s a really interesting corollary: If you’re on a small team (~5 people) the person obsessed with access controls cannot be trusted.
- ww520 2y ago
  While it’s regrettable you had someone you trusted betrayed you, the lesson is more of never share your password manager with others.
  - swat535 2y ago
    Exactly, it’s like people complaining about locks when they hand over their keys to another person and suffer theft. The lesson here is using granular permissions and sharing things selectively, more importantly never giving master access to anyone.
nlawalker 2y ago
You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It's the same idea with using a password manager in the first place - if a password manager is going to be the thing that gets you to use secure passwords that vary across services, it's worth the tradeoff of having all of those passwords in one place, because you're much more likely to be compromised by a bad password than by a password manager leak.
- jasonjayr 2y ago
  The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you. At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.
  - ziml77 2y ago
    Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.
    - bluGill 2y ago
      The password is generally the weak point. If you can remember it any modern computer can guess it in a short time. Which is why password generation is so imporant.
      - baliex 2y ago
        > If you can remember it any modern computer can guess it in a short time. That's not true. A long sentence of your choosing is easy to memorise and plenty long enough to not be able to be guessed by a computer (brute force).
lazyeye 2y ago
When I upgrade my phone, I keep the old one as a backup and load the same OTP codes into the authenticator app on my new phone. It is no problem to have OTP codes on multiple phones.
yapyap 2y ago
cause the risk isnt in hackers hacking your password manager
kardianos 2y ago
If useful to this crowd. I use keepassx, I made a way to easily print off key passwords along with their instructions: https://github.com/kardianos/safekeysheet https://github.com/kardianos/safekeysheet It could be modified to also print out the otp as well if stored.
_1tem 2y ago
Important to note that not all password managers are equal. Using Apple’s built-in password manager is more secure because it is inherently tied to your biometrics and authentication is hardware-based, i.e Secure Enclave. This is categorically different from web services like Bitwarden or 1Password authenticated by login email and 2FA codes. Even if someone got into your Apple ID they still would be unable to view or sync your passwords without biometrics.
- watermelon0 2y ago
  iCloud syncs passwords between your devices. If someone can login via your Apple ID, which means that the person knows username/password, and can also convince you to provide them with 2FA code that gets shown on your existing device, they can just add a new device to your account, and get passwords to sync to it.
  - alehlopeh 2y ago
    If someone knows your username and password and can convince you to give them a TOTP code, then yeah they can log in to your account. That’s hardly iCloud-specific.
    - _1tem 2y ago
      iCloud Passwords is more secure than that. Even a TOTP code and password is not enough to initiate a password sync. You also need to biometrically authenticate a previously synced device
      - pohuing 2y ago
        Thinking about it, what happens if you lose your eyes or your fingercups(say for example from frostbite). Are you just screwed or is there a recovery method
        _1tem 2y ago
        I make my own encrypted backups from CSV exports.
conception 2y ago
Using 1Password requires me to use one of my devices to add a device to my account. If someone has my password and my device how will a separate app help me in this case? Honest question as the 1password model seems to be “something you know and something you have”.
- baobabKoodaa 2y ago
  If someone hacks 1Password, they will get access to all your accounts. Whereas if you moved TOTP off 1Password, that hacker would no longer be able to access your accounts.
  - conception 2y ago
    If someone hacks 1Password, they get an encrypted vault. 1Password has no access to my passwords. There is no recovery mechanism without the encryption keys or a device on the account.
1123581321 2y ago
Good advice in this article. Keeping TOTP in a good password manager removes risk of making mistakes with the codes by tying it to the same auth sequence as the password. The assurance that the codes are securely stored, easy to use and to establish on a new trusted device lets services be used confidently which don’t allow vulnerable bypassing of credentials with easily purchased proofs (SSNs, street address etc.) Backing up TOTP seeds encrypted is a good idea if you know what you’re doing. It is a security-improving move when humans are factored in, not a trade-off between security and convenience.
taviso 2y ago
I'm not familiar with the expert they consulted, but the claim that "The main advantage of 2FA is that it is much more difficult to gain access to your accounts via phishing attacks" is just plain false. TOTP or SMS-2FA are obviously phishable, if you just entered your password into a phishing site, why wouldn't you also enter a TOTP code? I usually point to Modlishka as a practical example (https://vimeo.com/308709275 https://vimeo.com/308709275) to help visualize this. In fact, the main (claimed) advantage of 2FA is that it prevents "Credential Stuffing" of reused passwords. I personally don't think TOTP (or similar) are a good solution to this problem at all, but this is a thorny issue.
- eblume 2y ago
  The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password. Your point that if you've already decided to enter your password then entering the 2FA code isn't much of a hurdle is sound, but from the perspective of a user of 1Password, it is indeed very surprising (and rare!) when I try to log in to a page and find that 1Password won't show my log in because the domains don't match. It happens, usually due to some cross-origin login flow, but it's rare. So I think the claim isn't false, it's just based on a premise that might not factor in for different people.
  - watermelon0 2y ago
    If domain doesn't match, password manager of choice will not suggest to populate credentials. In that case it doesn't matter if 2FA is saved by the password manager, or is managed on another device, because you won't have the chance to use the 2FA. If domain doesn't match, and you manually copy the password, and login, you can as well manually copy the 2FA code.
  - Dylan16807 2y ago
    > The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password. Yes, same with the password. So it is not an advantage of 2FA.
- 2y ago
superultra 2y ago
The primary reason I used 1password + 2FA at both my business and in my family is really simple: 1password creates a shared 2FA process. That is, I can create a 2FA login that someone else in my team or family can also access.
1970-01-01 2y ago
I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?
- sneak 2y ago
  The most common 2FA mobile app that isn’t a password manager is Google Authenticator. Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Also, TOTP in general is bad, because it is easily phished, just like passwords. Using a password manager to store TOTP cuts down on phishing risk as it won’t input them into the wrong domain site. Copying them manually from a different app is still vulnerable to phishing.
  - Scion9066 2y ago
    Google Authenticator does support exporting and syncing now: https://security.googleblog.com/2023/04/google-authenticator-now-supports.html https://security.googleblog.com/2023/04/google-authenticator...
  - doodlesdev 2y ago
    > Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Not true anymore. [0] [0]: https://www.theverge.com/2023/4/24/23696058/google-authenticator-app-account-syncing-multiple-devices https://www.theverge.com/2023/4/24/23696058/google-authentic...
  - pwg 2y ago
    FreeOTP+, available on FDroid [1] provides for import/export of one's stored codes. The problem with "phishing" is not the technology. Phishing is 100% a human issue and no matter what tech. you might use, those humans vulnerable to being phished will find a way to be phished. [1] https://f-droid.org/en/packages/org.liberty.android.freeotpplus/ https://f-droid.org/en/packages/org.liberty.android.freeotpp...
kazinator 2y ago
The author of this article is unaware of the possibility of an audience who has no idea what the use case looks like for a short temporary token to be stored in a semi-permanent store like a password manager; what does it do? How does the token get there, and how is it used? Does the password manager infrastructure have access to the stream of tokens so that it populates the latest one, and fills it in for you when you're authenticating? Obviously any manual step in handling the token via the password manager will be worse (or no better) than just entering the token manually into the authentication dialog, so it has to work that way?
xlii 2y ago
This might not be solution for everyone but wouldn’t the best protection to use two separate password managers? One for passwords and the other for the TOTPs? I wonder why service providers don't have it already. They could even help ensuring that the passwords are different and provide some interoperability between both vaults (e.g. TOTP on mobile device is passed to PC password completions)
gchamonlive 2y ago
It's better than not having 2fa, but a breach to your password manager would give any attacker full control over your accounts. A better approach would be to split in two solutions where you store passwords and 2fa keys. I use bitwarden for passwords, but save all 2fa in aegis. These two have different 5 word passphrases prefixed with a regular 8 char password to increase entropy. I save a backup of the 2fa db to a replicated storage with a synthetic password. For bitwarden I delegate persistence of the data to bitwarden, but it would make sense to take encrypted backups regularly. The disaster recover protocol is to have a smaller 2fa encrypted database printed in paper. I know the password to this db. Recovering this DB gives me access to bitwarden and the cloud storage, which gives me access to the rest of my password and keys.
- kcartlidge 2y ago
  Similar - I use Bitwarden for passwords and Authy for 2FA so a compromise of only one of them is not a disaster (assuming a site supports 2FA which my important ones largely do).
  - gchamonlive 2y ago
    Authy is nice because it takes care of replication, but once you have all your devices synced I'd disable adding new devices, otherwise it'll expose your 2fa in case of SIM card breaches
kif 2y ago
People advocating against storing 2FA codes in the password manager are correct from a purist perspective, but not from a pragmatic perspective if you ask me. If my device is compromised, along with my device's password, as well as the password manager's password, then yeah... I'm screwed. As long as I keep my devices up-to-date though, I believe the highest risk comes from state-sponsored actors. I've chosen convenience, and I've made my peace with it.
complex_pi 2y ago
A file-based password manager ils something you have (the file) and something you know (the master password) provided you have a timeout on the password manager and a safe screensaver. (In reply to some comments below). It does require some thought / hygiene but seems a fair compromise.
skybrian 2y ago
More generally: the world would be a better place if most people relied on password managers. If you can do it reliably, using any password manager, even the one built into your browser or OS, is better than not using one. The problem is that it requires a certain amount of good hygiene when it comes to computer equipment. There are many people who are bad with computers, who don’t have phone backups and lose their phone, who will share accounts and devices, and so on. The result is an insecure mess. So, solving the “people should use a password manager” problem requires solving all the other issues surrounding how non-technical people use and misuse computer equipment, so that having a password manager and not losing the essential data stored in it becomes the default. For some people, it would probably be safer and easier to write down your passwords on paper, in a notebook. Other people will lose the notebook, or have it stolen from them. There are similar but more complicated issues with holding onto computer devices.
- raywu 2y ago
  Isn’t this what passkey is trying to sidestep? Assuming the user is at least authenticated on one device.
  - cuu508 2y ago
    For people who are bad with computers, I think passkeys could work ok in scenario where somebody has just one device, they never upgrade it, never lose it, never break it, never accidentally click on "log out" in their passkey provider's account.
    - skybrian 2y ago
      In other words, having just one device is as bad as having just one key to a safe. You need redundancy to avoid getting locked out.
mid-kid 2y ago
The reason I store 2FA codes in my password manager is as a protest to companies forcing me to have a 2FA. I don't want to be randomly locked out of my google account due to not having a usable 2FA, and I also don't want to depend on having a single device be always available to provide the codes. In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwords for every service. The phishing-resistance is nice, but I'd prefer it being the only credential, and just having it be autofilled (making it longer to combat bruteforce), like what we currently have with password managers... Here's to hoping passkeys turn out any better.
- loeg 2y ago
  > In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwords for every service. Right. This is the killer features of passkeys.
- ghjfrdghibt 2y ago
  Passkeys are a shitshow at the moment, I store passkeys in my password manager along with 2fa codes as it is the only way to make them reasonably usable. And obviously the only other way to manage passkeys is to rely either on a single device, trust big corps and vendor lock in, or to have multiple passkeys on multiple devices/services for the same sites/accounts.
- forty 2y ago
  Yes, my point of view is that using a password manager with unique and strong passwords everywhere is bringing most of the benefits you get with TOTP, and then you can have TOTP for compliance with security policy only.
- WhyNotHugo 2y ago
  FWIW, you can store 2FA/TOTP tokens on more than one device. For example, I store many on two separate Yubikeys. Then again, I do this for accounts that I really care about, I just keep TOTP in my password manager for accounts that are not worth the effort.
jopsen 2y ago
I really wish we could store passkeys and totp in bitwarden where access always goes through a server side KMS. Currently, bitwarden stores these encrypted, but they are unlocked with the rest of the password manager. For now I'll stick to yubikey for 2FA. But I wish I could use bitwarden as a layer of abstraction, such that bitwarden would always require my yubikey before allowing any of the passkeys or totp keys to be used.
loeg 2y ago
Basically because 2FA is a useless nuisance when you've got unique high entropy passwords that can't be stuffed, and it's not a defense against your entire password corpus being leaked.
hackerbrother 2y ago
Ultimately, you have to store your backup codes somewhere. So the only solution besides using your password manager is using a second password manager. Or not using a password manager to save off your backup codes, which has its own disadvantages. There's lots of cases where 2FA reduces to 1FA. E.g. logging into a website on your mobile phone, and getting your TOTP or SMS code on that same phone. In fact-- that case is so common I wonder if we should just get more used to the idea of 1FA, with smartphone passkeys/biometrics/SSO being the auth factor. As it stands, if you compromise someone's smartphone (and have their smartphone PIN), the odds are great you can autofill any password you like on their phone and pull up any needed 2FA tokens as well.
ww520 2y ago
One of the risks of 2FA is losing access to your accounts after losing the authenticating device. Backing up the 2FA seeds mitigates that risk. The backup needs to be encrypted with the password remembered and stored somewhere. Sounds like it’s a job for a password manager, preferably in an offline local password manager with a different database.
- rsync 2y ago
  "One of the risks of 2FA is losing access to your accounts after losing the authenticating device." A "2FA Mule"[1] solves this problem by staying in one place with constant power. I receive plain old SMS 2FA codes while flying in an airplane. I also don't care that much if I lose or destroy my personal mobile. In fact, I don't even know my current SIM number. If I lose my personal mobile I just edit a twiml bin at Twilio and point my number somewhere else ... [1] https://kozubik.com/items/2famule/ https://kozubik.com/items/2famule/
VoodooJuJu 2y ago
[dead]
cycomanic 2y ago
It's interesting how many argue that putting 2FA codes into a password manager is wrong because you combine 2 factors into one (not don't fully agree with that reasoning), but then are happy with passkeys. How are passkeys better?
- ghshephard 2y ago
  Passkeys aren't susceptible to phishing. 2FA TOTP is. Also -your seed/token can be trivially stolen from a password manager. Getting the passkey private key somewhat more challenging.
- WhyNotHugo 2y ago
  Passkeys are 1 factor authentication. They are often better than only using a password (merely due to the fact that most humans pick terrible passwords). But using a password + 2FA generally is safer than passkeys. This is especially true if you use webauthn for 2FA, since now one of your factors is basically the passkey.
alistairSH 2y ago
Maybe there’s a language issue here… but would any saved 2FA code be expired the next time you retrieved it from your password manager? They’re generated for one-time use and have an expiration, right? Or, when the author says “save the 2FA code” does he really mean “use the password manager to generate the 2FA codes”?
Eric_WVGG 2y ago
A good explanation for the layperson is: MFA means access requires something you know (a password) and something you have. In the early days of MFA that thing meant a cellphone because it was SMS by default, but yeah, a laptop or computer of any kind is a "thing you have" as well.
aftbit 2y ago
IMO the real advantages of 2FA are threefold: 1. The key is generated by the server, not the client (human), so it cannot be reused like a password. 2. The authentication is temporally bound, so phishing only offers access for ~30 seconds, unlike a password where it provides unlimited access until someone changes it (never unless forced in practice). 3. It's literally required for many services, so you need to use it. The alternatives to storing your secrets in your password manager are keeping them on your phone (which is how most people log in anyway, so its already becoming a single point of failure) or using something like SMS 2FA, which is even worse as SIM jacking is pretty trivially possible on most providers.
evanjrowley 2y ago
For a few years I've used the exact same setup as the author in regards to my TOTP codes, password manager, and WebAuthn hardware keys. This past year, I've supplemented this with biometric passkeys on Windows, Apple, and Android.
WhyNotHugo 2y ago
The first reasoning basically summarises to "storing 2FA token in a password manager protects against phishing because the TOTP token won't be autocompleted on the wrong domain". Any decent password manager would avoid autocompleting the password on the wrong domain in the first place. I.e.: it will already protect against phishing attacks anyway. 1Password's documentation use to have a whole article about how bad an idea it was to store TOTP in a password manager — but their stance completely changed at some point. Around the same time they started _recommending_ that you do so, and presented it as a key feature in the marketing material. --- Personally, I think that the only valid reason to store a TOTP secret in password manger is when you don't really care too much about an account (e.g.: prefer convenience over security), but the website demands that I set up 2FA.
LorenzoGood 2y ago
I do it for some accounts where I don't care that much about having 2fa, but its forced, and its easier than getting SMS notifications.
Peterthomos 2y ago
[dead]

107 points by andygrunwald 2y ago

Related: Why is it a good idea to store 2FA tokens in 1Password? https://1password.community/discussion/comment/496555 https://1password.community/discussion/comment/496555

ezfe 2y ago

TLDR: Account security is a balance and saving it in a password manager has more benefits than downsides

bloopernova 2y ago

Because there's a trade-off between security and convenience.

declan_roberts 2y ago
Exactly, and is there material difference between OTP in a password manager and a passkey in the password manager?
- lesuorac 2y ago
  Probably. I would bet there are some systems that accept a passkey in a situation that they don't accept a password.
- rlk 2y ago
  There are a couple of differences: 1. While a password manager should associate a TOTP seed with a domain and only fill codes on that domain, the codes are still visible to you. A convincing phishing attack might trick you into manually entering a code into a fake page. Passkeys don't allow this. 2. TOTP codes are derived from a seed shared between the client and server, so an attacker who gets read access to the server's database could generate your codes. With passkeys, the server can only validate a signature, not generate them.
  - pwg 2y ago
    > A convincing phishing attack might trick you into manually entering a code into a fake page. Sadly, for a far too large population of users, a convincing phishing attack will be successful, even if the tech. is flashing ten different warnings of "this is a phishing attack page" at the same time. You can't "technology" around human nature for a subset of the population.

Alex-Programs 2y ago

I store 2FA keys in a fingerprint protected Aegis vault on my phone, and I periodically export an encrypted (with a master password I remember) backup that I then email to my parents. I get their argument that 2FA makes phishing more difficult, but I disagree that it's its "primary use", or that the distributed factor is unimportant. I personally wouldn't feel comfortable having all my important accounts behind Bitwarden's single point of failure. 2FA for important accounts mitigates the damage if my Bitwarden is broken into.

gruez 2y ago

>A time-based 2FA (TOTP) is time-sensitive, and a man-in-the-middle or proxy needs to be set up to capture that in real-time Is that supposed to be remotely difficult? It'll take maybe an hour to whip up a script that takes the captured credentials, passes it onto a headless browser to attempt the login, capture the session cookie, and optionally refresh the page regularly to keep the session active.

bsza 2y ago
Unless the page gives you a captcha before the TOTP, which it definitely should.
- gruez 2y ago
  None of my bank accounts use a login captcha. Presumably they mitigate bruteforcing using lockouts or similar. Even if they use captchas, captcha solving services exist that solve for less than a cent per solve. It's not a huge barrier.
- dns_snek 2y ago
  Modern captchas only deter humans, bots will pass right through.

notorandit 2y ago

You may say I am a dreamer, but I am not the only one! Storing 2FA codes in your password manager is not a good idea at all in case you get it breached. Otherwise it could be a convenient idea. If your password manager gets breached you could also loose control of your 2FA as it can be replaced as well. We need to securely store our 2FA codes, sure. But I would advise not to use the "normal" password manager. I for use have them printed on paper.

cheald 2y ago

I think it's a terrible idea, because it dramatically decreases the attack surface area needed to compromise accounts. 2FA is supposed to be "something you know' and "something you have"; putting your 2FA seeds into your password manager reduces your 2FA to "something you know", and, significantly worse, it's "something you know in the same place as the other thing you know". The time-variant component is still quite valuable, but it does nothing to protect you in the event of a password manager compromise. This is not a hypothetical; LastPass has suffered multiple breaches, and the more popular a solution, the more likely there are to be attacks against that solution. By keeping your 2FA separate from your password manager, even if it's still just "something you know", it's something you know in a location that's orthogonal to your passwords. If I yield to convenience and use a 2FA desktop app, then now, instead of just attacking my Bitwarden install, you have to successfully attack my Bitwarden install and my 2FA desktop app install to get access to my accounts, and the combination of password managers * 2FA managers is a substantially larger attack surface and requires a significantly more sophisticated attack to get both pieces. The arguments in the article come down to "well, 2FA mitigates phishing attacks" (true) and "Google Authenticator means you can lose your data easily" (also true). But neither of these is a good argument for why the data should be kept together. It just means "use 2FA", and "use a 2FA manager that lets you directly manage your seeds and keep offsite encrypted backups". If you can't be bothered to do it properly, then 2FA codes in your password manager is certainly better than not using 2FA at all, but that just makes it a less terrible solution, not a good one.

Al-Khwarizmi 2y ago
You speak as if 2FA were something that most people use willingly and not just something they put up with because they're forced to.
- cheald 2y ago
  Which is precisely why it's irresponsible to give people the rope to hang themselves with by supporting 2FA seeds in password managers (much less telling them it's a good idea), IMO. People take the path of least resistance; we know this. It's why, for the longest time, people used one password for everything. People don't like using password managers, either, but we would all agree that it's unacceptably insecure to not use them, because the alternative is "one password used everywhere, maybe with a single varying digit on the end".

throwpoaster 2y ago

I had my password manager compromised by a business partner. I added him to my 1Password account and then, in a play for control of the company, he attempted to remove me. Lesson learned: don't try to save money on password managers. If all of my 2FA code generators had been in 1Password I would have been truly screwed, but in a stroke of luck I had been paranoid enough to use a separate app for 2FA codes.

kubo6472 2y ago
I'm sorry this happened to you, but it highlights another very important factor. Don't keep all keys to the kingdom on one person. Always divide and conquer. Keep power distributed between multiple people. I worked at a company of 500+ people, and I'm sure the CEO didn't have access to all the IT people's stuff. They only cared that everything works and meet their quarterly goals. Shall the IT person feel like sabotaging stuff, there are distributed backups and mainly the fine print in the work contract preventing that. I know this doesn't necessarily apply to smaller companies and startups, but have lawyers write you strong contracts that aren't one-sided, but are full of protections for both sides, if they aren't sabotaging stuff.
- throwpoaster 2y ago
  This, yes, but there’s a really interesting corollary: If you’re on a small team (~5 people) the person obsessed with access controls cannot be trusted.
ww520 2y ago
While it’s regrettable you had someone you trusted betrayed you, the lesson is more of never share your password manager with others.
- swat535 2y ago
  Exactly, it’s like people complaining about locks when they hand over their keys to another person and suffer theft. The lesson here is using granular permissions and sharing things selectively, more importantly never giving master access to anyone.

nlawalker 2y ago

You are better off security-wise with 2FA enabled than without it (for the phishing-related reasons mentioned in TFA - EDIT: taviso is correct in their comment, it's more about protection against credential stuffing than phishing), regardless of where you put the codes, so if being able to put the codes in your password manager is going to be the difference-maker in someone electing to use 2FA, they should do it. It's the same idea with using a password manager in the first place - if a password manager is going to be the thing that gets you to use secure passwords that vary across services, it's worth the tradeoff of having all of those passwords in one place, because you're much more likely to be compromised by a bad password than by a password manager leak.

jasonjayr 2y ago
The risk is that if your password manager's database is stolen, then an attacker can do an offline decryption attack on it, and should they succeed, they have both parts of the login to compromise you. At the very least, you SHOULD keep the 2FA credentials in a separate database (IE, keepassxc can keep multiple databases), so an attacker would need to double their efforts to get both parts of the login.
- ziml77 2y ago
  Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.
  - bluGill 2y ago
    The password is generally the weak point. If you can remember it any modern computer can guess it in a short time. Which is why password generation is so imporant.
    - baliex 2y ago
      > If you can remember it any modern computer can guess it in a short time. That's not true. A long sentence of your choosing is easy to memorise and plenty long enough to not be able to be guessed by a computer (brute force).

lazyeye 2y ago

When I upgrade my phone, I keep the old one as a backup and load the same OTP codes into the authenticator app on my new phone. It is no problem to have OTP codes on multiple phones.

yapyap 2y ago

cause the risk isnt in hackers hacking your password manager

kardianos 2y ago

If useful to this crowd. I use keepassx, I made a way to easily print off key passwords along with their instructions: https://github.com/kardianos/safekeysheet https://github.com/kardianos/safekeysheet It could be modified to also print out the otp as well if stored.

_1tem 2y ago

Important to note that not all password managers are equal. Using Apple’s built-in password manager is more secure because it is inherently tied to your biometrics and authentication is hardware-based, i.e Secure Enclave. This is categorically different from web services like Bitwarden or 1Password authenticated by login email and 2FA codes. Even if someone got into your Apple ID they still would be unable to view or sync your passwords without biometrics.

watermelon0 2y ago
iCloud syncs passwords between your devices. If someone can login via your Apple ID, which means that the person knows username/password, and can also convince you to provide them with 2FA code that gets shown on your existing device, they can just add a new device to your account, and get passwords to sync to it.
- alehlopeh 2y ago
  If someone knows your username and password and can convince you to give them a TOTP code, then yeah they can log in to your account. That’s hardly iCloud-specific.
  - _1tem 2y ago
    iCloud Passwords is more secure than that. Even a TOTP code and password is not enough to initiate a password sync. You also need to biometrically authenticate a previously synced device
    - pohuing 2y ago
      Thinking about it, what happens if you lose your eyes or your fingercups(say for example from frostbite). Are you just screwed or is there a recovery method
      - _1tem 2y ago
        I make my own encrypted backups from CSV exports.

conception 2y ago

Using 1Password requires me to use one of my devices to add a device to my account. If someone has my password and my device how will a separate app help me in this case? Honest question as the 1password model seems to be “something you know and something you have”.

baobabKoodaa 2y ago
If someone hacks 1Password, they will get access to all your accounts. Whereas if you moved TOTP off 1Password, that hacker would no longer be able to access your accounts.
- conception 2y ago
  If someone hacks 1Password, they get an encrypted vault. 1Password has no access to my passwords. There is no recovery mechanism without the encryption keys or a device on the account.

1123581321 2y ago

Good advice in this article. Keeping TOTP in a good password manager removes risk of making mistakes with the codes by tying it to the same auth sequence as the password. The assurance that the codes are securely stored, easy to use and to establish on a new trusted device lets services be used confidently which don’t allow vulnerable bypassing of credentials with easily purchased proofs (SSNs, street address etc.) Backing up TOTP seeds encrypted is a good idea if you know what you’re doing. It is a security-improving move when humans are factored in, not a trade-off between security and convenience.

taviso 2y ago

I'm not familiar with the expert they consulted, but the claim that "The main advantage of 2FA is that it is much more difficult to gain access to your accounts via phishing attacks" is just plain false. TOTP or SMS-2FA are obviously phishable, if you just entered your password into a phishing site, why wouldn't you also enter a TOTP code? I usually point to Modlishka as a practical example (https://vimeo.com/308709275 https://vimeo.com/308709275) to help visualize this. In fact, the main (claimed) advantage of 2FA is that it prevents "Credential Stuffing" of reused passwords. I personally don't think TOTP (or similar) are a good solution to this problem at all, but this is a thorny issue.

eblume 2y ago
The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password. Your point that if you've already decided to enter your password then entering the 2FA code isn't much of a hurdle is sound, but from the perspective of a user of 1Password, it is indeed very surprising (and rare!) when I try to log in to a page and find that 1Password won't show my log in because the domains don't match. It happens, usually due to some cross-origin login flow, but it's rare. So I think the claim isn't false, it's just based on a premise that might not factor in for different people.
- watermelon0 2y ago
  If domain doesn't match, password manager of choice will not suggest to populate credentials. In that case it doesn't matter if 2FA is saved by the password manager, or is managed on another device, because you won't have the chance to use the 2FA. If domain doesn't match, and you manually copy the password, and login, you can as well manually copy the 2FA code.
- Dylan16807 2y ago
  > The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password. Yes, same with the password. So it is not an advantage of 2FA.
2y ago

superultra 2y ago

The primary reason I used 1password + 2FA at both my business and in my family is really simple: 1password creates a shared 2FA process. That is, I can create a 2FA login that someone else in my team or family can also access.

1970-01-01 2y ago

I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?

sneak 2y ago
The most common 2FA mobile app that isn’t a password manager is Google Authenticator. Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Also, TOTP in general is bad, because it is easily phished, just like passwords. Using a password manager to store TOTP cuts down on phishing risk as it won’t input them into the wrong domain site. Copying them manually from a different app is still vulnerable to phishing.
- Scion9066 2y ago
  Google Authenticator does support exporting and syncing now: https://security.googleblog.com/2023/04/google-authenticator-now-supports.html https://security.googleblog.com/2023/04/google-authenticator...
- doodlesdev 2y ago
  > Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad. Not true anymore. [0] [0]: https://www.theverge.com/2023/4/24/23696058/google-authenticator-app-account-syncing-multiple-devices https://www.theverge.com/2023/4/24/23696058/google-authentic...
- pwg 2y ago
  FreeOTP+, available on FDroid [1] provides for import/export of one's stored codes. The problem with "phishing" is not the technology. Phishing is 100% a human issue and no matter what tech. you might use, those humans vulnerable to being phished will find a way to be phished. [1] https://f-droid.org/en/packages/org.liberty.android.freeotpplus/ https://f-droid.org/en/packages/org.liberty.android.freeotpp...

kazinator 2y ago

The author of this article is unaware of the possibility of an audience who has no idea what the use case looks like for a short temporary token to be stored in a semi-permanent store like a password manager; what does it do? How does the token get there, and how is it used? Does the password manager infrastructure have access to the stream of tokens so that it populates the latest one, and fills it in for you when you're authenticating? Obviously any manual step in handling the token via the password manager will be worse (or no better) than just entering the token manually into the authentication dialog, so it has to work that way?

xlii 2y ago

This might not be solution for everyone but wouldn’t the best protection to use two separate password managers? One for passwords and the other for the TOTPs? I wonder why service providers don't have it already. They could even help ensuring that the passwords are different and provide some interoperability between both vaults (e.g. TOTP on mobile device is passed to PC password completions)

gchamonlive 2y ago

It's better than not having 2fa, but a breach to your password manager would give any attacker full control over your accounts. A better approach would be to split in two solutions where you store passwords and 2fa keys. I use bitwarden for passwords, but save all 2fa in aegis. These two have different 5 word passphrases prefixed with a regular 8 char password to increase entropy. I save a backup of the 2fa db to a replicated storage with a synthetic password. For bitwarden I delegate persistence of the data to bitwarden, but it would make sense to take encrypted backups regularly. The disaster recover protocol is to have a smaller 2fa encrypted database printed in paper. I know the password to this db. Recovering this DB gives me access to bitwarden and the cloud storage, which gives me access to the rest of my password and keys.

kcartlidge 2y ago
Similar - I use Bitwarden for passwords and Authy for 2FA so a compromise of only one of them is not a disaster (assuming a site supports 2FA which my important ones largely do).
- gchamonlive 2y ago
  Authy is nice because it takes care of replication, but once you have all your devices synced I'd disable adding new devices, otherwise it'll expose your 2fa in case of SIM card breaches

kif 2y ago

People advocating against storing 2FA codes in the password manager are correct from a purist perspective, but not from a pragmatic perspective if you ask me. If my device is compromised, along with my device's password, as well as the password manager's password, then yeah... I'm screwed. As long as I keep my devices up-to-date though, I believe the highest risk comes from state-sponsored actors. I've chosen convenience, and I've made my peace with it.

complex_pi 2y ago

A file-based password manager ils something you have (the file) and something you know (the master password) provided you have a timeout on the password manager and a safe screensaver. (In reply to some comments below). It does require some thought / hygiene but seems a fair compromise.

skybrian 2y ago

More generally: the world would be a better place if most people relied on password managers. If you can do it reliably, using any password manager, even the one built into your browser or OS, is better than not using one. The problem is that it requires a certain amount of good hygiene when it comes to computer equipment. There are many people who are bad with computers, who don’t have phone backups and lose their phone, who will share accounts and devices, and so on. The result is an insecure mess. So, solving the “people should use a password manager” problem requires solving all the other issues surrounding how non-technical people use and misuse computer equipment, so that having a password manager and not losing the essential data stored in it becomes the default. For some people, it would probably be safer and easier to write down your passwords on paper, in a notebook. Other people will lose the notebook, or have it stolen from them. There are similar but more complicated issues with holding onto computer devices.

raywu 2y ago
Isn’t this what passkey is trying to sidestep? Assuming the user is at least authenticated on one device.
- cuu508 2y ago
  For people who are bad with computers, I think passkeys could work ok in scenario where somebody has just one device, they never upgrade it, never lose it, never break it, never accidentally click on "log out" in their passkey provider's account.
  - skybrian 2y ago
    In other words, having just one device is as bad as having just one key to a safe. You need redundancy to avoid getting locked out.

mid-kid 2y ago

The reason I store 2FA codes in my password manager is as a protest to companies forcing me to have a 2FA. I don't want to be randomly locked out of my google account due to not having a usable 2FA, and I also don't want to depend on having a single device be always available to provide the codes. In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwords for every service. The phishing-resistance is nice, but I'd prefer it being the only credential, and just having it be autofilled (making it longer to combat bruteforce), like what we currently have with password managers... Here's to hoping passkeys turn out any better.

loeg 2y ago
> In practice, I feel the main reason 2FA is popular is because people cannot be trusted to create unique and secure passwords for every service. Right. This is the killer features of passkeys.
ghjfrdghibt 2y ago
Passkeys are a shitshow at the moment, I store passkeys in my password manager along with 2fa codes as it is the only way to make them reasonably usable. And obviously the only other way to manage passkeys is to rely either on a single device, trust big corps and vendor lock in, or to have multiple passkeys on multiple devices/services for the same sites/accounts.
forty 2y ago
Yes, my point of view is that using a password manager with unique and strong passwords everywhere is bringing most of the benefits you get with TOTP, and then you can have TOTP for compliance with security policy only.
WhyNotHugo 2y ago
FWIW, you can store 2FA/TOTP tokens on more than one device. For example, I store many on two separate Yubikeys. Then again, I do this for accounts that I really care about, I just keep TOTP in my password manager for accounts that are not worth the effort.

jopsen 2y ago

I really wish we could store passkeys and totp in bitwarden where access always goes through a server side KMS. Currently, bitwarden stores these encrypted, but they are unlocked with the rest of the password manager. For now I'll stick to yubikey for 2FA. But I wish I could use bitwarden as a layer of abstraction, such that bitwarden would always require my yubikey before allowing any of the passkeys or totp keys to be used.

loeg 2y ago

Basically because 2FA is a useless nuisance when you've got unique high entropy passwords that can't be stuffed, and it's not a defense against your entire password corpus being leaked.

hackerbrother 2y ago

Ultimately, you have to store your backup codes somewhere. So the only solution besides using your password manager is using a second password manager. Or not using a password manager to save off your backup codes, which has its own disadvantages. There's lots of cases where 2FA reduces to 1FA. E.g. logging into a website on your mobile phone, and getting your TOTP or SMS code on that same phone. In fact-- that case is so common I wonder if we should just get more used to the idea of 1FA, with smartphone passkeys/biometrics/SSO being the auth factor. As it stands, if you compromise someone's smartphone (and have their smartphone PIN), the odds are great you can autofill any password you like on their phone and pull up any needed 2FA tokens as well.

ww520 2y ago

One of the risks of 2FA is losing access to your accounts after losing the authenticating device. Backing up the 2FA seeds mitigates that risk. The backup needs to be encrypted with the password remembered and stored somewhere. Sounds like it’s a job for a password manager, preferably in an offline local password manager with a different database.

rsync 2y ago
"One of the risks of 2FA is losing access to your accounts after losing the authenticating device." A "2FA Mule"[1] solves this problem by staying in one place with constant power. I receive plain old SMS 2FA codes while flying in an airplane. I also don't care that much if I lose or destroy my personal mobile. In fact, I don't even know my current SIM number. If I lose my personal mobile I just edit a twiml bin at Twilio and point my number somewhere else ... [1] https://kozubik.com/items/2famule/ https://kozubik.com/items/2famule/

VoodooJuJu 2y ago

[dead]

cycomanic 2y ago

It's interesting how many argue that putting 2FA codes into a password manager is wrong because you combine 2 factors into one (not don't fully agree with that reasoning), but then are happy with passkeys. How are passkeys better?

ghshephard 2y ago
Passkeys aren't susceptible to phishing. 2FA TOTP is. Also -your seed/token can be trivially stolen from a password manager. Getting the passkey private key somewhat more challenging.
WhyNotHugo 2y ago
Passkeys are 1 factor authentication. They are often better than only using a password (merely due to the fact that most humans pick terrible passwords). But using a password + 2FA generally is safer than passkeys. This is especially true if you use webauthn for 2FA, since now one of your factors is basically the passkey.

alistairSH 2y ago

Maybe there’s a language issue here… but would any saved 2FA code be expired the next time you retrieved it from your password manager? They’re generated for one-time use and have an expiration, right? Or, when the author says “save the 2FA code” does he really mean “use the password manager to generate the 2FA codes”?

Eric_WVGG 2y ago

A good explanation for the layperson is: MFA means access requires something you know (a password) and something you have. In the early days of MFA that thing meant a cellphone because it was SMS by default, but yeah, a laptop or computer of any kind is a "thing you have" as well.

aftbit 2y ago

IMO the real advantages of 2FA are threefold: 1. The key is generated by the server, not the client (human), so it cannot be reused like a password. 2. The authentication is temporally bound, so phishing only offers access for ~30 seconds, unlike a password where it provides unlimited access until someone changes it (never unless forced in practice). 3. It's literally required for many services, so you need to use it. The alternatives to storing your secrets in your password manager are keeping them on your phone (which is how most people log in anyway, so its already becoming a single point of failure) or using something like SMS 2FA, which is even worse as SIM jacking is pretty trivially possible on most providers.

evanjrowley 2y ago

For a few years I've used the exact same setup as the author in regards to my TOTP codes, password manager, and WebAuthn hardware keys. This past year, I've supplemented this with biometric passkeys on Windows, Apple, and Android.

WhyNotHugo 2y ago

The first reasoning basically summarises to "storing 2FA token in a password manager protects against phishing because the TOTP token won't be autocompleted on the wrong domain". Any decent password manager would avoid autocompleting the password on the wrong domain in the first place. I.e.: it will already protect against phishing attacks anyway. 1Password's documentation use to have a whole article about how bad an idea it was to store TOTP in a password manager — but their stance completely changed at some point. Around the same time they started _recommending_ that you do so, and presented it as a key feature in the marketing material. --- Personally, I think that the only valid reason to store a TOTP secret in password manger is when you don't really care too much about an account (e.g.: prefer convenience over security), but the website demands that I set up 2FA.

LorenzoGood 2y ago

I do it for some accounts where I don't care that much about having 2fa, but its forced, and its easier than getting SMS notifications.

Peterthomos 2y ago

[dead]