News for hackers. Stuff that matters.

A comment on Google: Security Keys Neutralized Employee Phishing. Parent comment

Re:Google: Security Keys Neutralized Employee Phishing by Phrodo_00 on Monday July 23, 2018 @02:33PM (#17594751)
which is why I'm wary of using my password manager for OTP, and use a separate one. Not sure if it's too paranoid, but it doesn't make sense to me to keep the 2 in the same place.
[ Parent | on HN ]
Re:Google: Security Keys Neutralized Employee Phishing by anfedorov on Saturday July 28, 2018 @10:54AM (#17633409)
There appear to be two points being conflated — 1/ 2FA via secrets stored on a separate device from your primary device with a PM provide more security than those stored on one device, and 2/ once you use a PM with unique password for every site, much of what OTP helps with for is already mitigated.

Both seem true, and what to do to protect yourself more depends on what kinds of attacks you're interested in stopping and at what costs. Personally, PM + U2F seems the highest-security, fastest-UI, easiest-UX by far — https://cloud.google.com/security-key/

[ Parent | on HN ]