News for hackers. Stuff that matters.

A comment on 2FA on the command line. Parent comment

Re:2FA on the command line by jacekm on Thursday February 28, 2019 @05:01PM (#19275694)
I think 2FA objective is to protect mainly from password leaks. If an attacker has access to the files on your laptop aren't they able to intercept 2FA codes too even if they are generated on another device? Such attacks are not purely theoretical we could observe them in real world.

Apart from that I believe that TOTP keys should be encrypted and that is actually my main issue with the described tool - it stores the keys in plain, in a config file.

[ Parent | on HN ]
Re:2FA on the command line by munchbunny on Thursday February 28, 2019 @05:04PM (#19275720)
2FA is to mitigate risk after the password is compromised, not to prevent password compromise in the first place.

That doesn't change the necessity of protecting TOTP keys, session keys, bearer tokens, etc., it's just that your second factor is supposed to be a parallel factor, not an extra lock around your password.

[ Parent | on HN ]