Re:Getting 2FA Right in 2019
by tptacek on Thursday June 20, 2019 @12:28PM
(#20234471)
Right, but you're mitigating an extremely marginal attack (a purely passive interception of a login) and enabling a somewhat more realistic attack, and for what? If you're just doing it to fake out 2FA requirements, sure, do whatever. But otherwise, just use 1Password passwords and skip the TOTP theater.
[ Parent
| on HN ]
Re:Getting 2FA Right in 2019
by reificator on Thursday June 20, 2019 @06:21PM
(#20237981)
> Right, but you're mitigating an extremely marginal attack (a purely passive interception of a login) and enabling a somewhat more realistic attack, and for what? If you're just doing it to fake out 2FA requirements, sure, do whatever. But otherwise, just use 1Password passwords and skip the TOTP theater.
Passive interception is not the only possibility. How many password dumps show up each year? Having TOTP enabled, regardless of where it is stored, helps mitigate that threat unless the password that is leaked can also access whatever is storing your TOTP secrets. But if you're using a password manager and reusing passwords, I don't know what to tell you.
Personally I use a TOTP implementation that lets me move the backing store as a file. It's not stored in my password manager, but it's available to me should I need to change phones. That seems like the best of all worlds.
Password leakage is not a marginal problem. I find saved passwords in public browsers all the time. Those with TOTP are much better protected against this as well.
Re:Getting 2FA Right in 2019
by the_common_man on Thursday June 20, 2019 @01:01PM
(#20234849)
Yeah, but you are not finding 1Password passwords in public browsers, are you?
1Password also has a web UI, so yes it is still very possible to copy a password from 1Password and accidentally save it on a public browser.
Not to mention the simplest: type in password from 1Password on phone on public browser. Accidentally save password.
Sadly, I found ones from colleagues that use 1Password and even to me it happened that I clicked save for password that I didn’t want to save in that environment.
Re:Getting 2FA Right in 2019
by ensignavenger on Thursday June 20, 2019 @03:54PM
(#20236692)
Ho does having TOTP in addition to a password versus just the password enable a more realistic attack?