Re:Getting 2FA Right in 2019
by shawnz on Thursday June 20, 2019 @12:05PM
(#20234239)
I think you are missing the parent's point. It's not just a matter of "secure/trusted" or "not secure/trusted". You could trust your password manager but that doesn't mean that compromise is impossible. One reason for having a second factor is to hedge your bets against the possibility that you mistakenly trusted a service that turned out to be insecure or to have attacks that you didn't consider or know about at the time.
[ Parent
| on HN ]
Re:Getting 2FA Right in 2019
by PuffinBlue on Thursday June 20, 2019 @12:34PM
(#20234547)
But that leads to something this whole discussion has made me think about - if the service is insecure my data can be hacked anyway. Add that to the fact I should be using unique passwords for each account I have.
So if both of those things are true - what does MFA get me?
You mean if BOTH services are insecure. That's the point, with 2FA you'd have to compromise TWO services to get access to all your accounts. As opposed to storing your TOTP keys in your password manager, where only one service would have to be compromised to get access to all your accounts.