News for hackers. Stuff that matters.

A comment on Turn on MFA Before Crooks Do It for You. Parent comment

Re:Turn on MFA Before Crooks Do It for You by cutemonster on Saturday June 20, 2020 @12:35PM (#23584818)
An attacker needs both the totp secret and the password, right?

(Just so I'm not misunderstanding something.)

[ Parent | on HN ]
Re:Turn on MFA Before Crooks Do It for You by saulrh on Saturday June 20, 2020 @06:47PM (#23588074)
Correct. So putting your TOTP codes in your password manager is no less safe than using the password manager in isolation, and likely substantially more safe, because it requires attackers to compromise your password manager in totality (which should be itself behind 2FA) rather than just phishing an individual password.
[ Parent | on HN ]
Re:Turn on MFA Before Crooks Do It for You by cutemonster on Saturday June 20, 2020 @06:59PM (#23588154)
They sort of need remote code execution on my laptop, I'm thinking.

Qubes OS maybe a good idea here -- isolated VMs. (One VM for the pwd manager)

[ Parent | on HN ]