News for hackers. Stuff that matters.

A comment on Aegis Authenticator – Open-source 2FA for Android. Parent comment

Re:Aegis Authenticator – Open-source 2FA for Android by mattrick on Sunday January 17, 2021 @12:36AM (#25808462)
Doesn't it kinda defeat the point of storing TOTP codes in your password manager?
[ Parent | on HN ]
Re:Aegis Authenticator – Open-source 2FA for Android by swirepe on Sunday January 17, 2021 @01:08AM (#25808578)
You wouldn't need to store the codes, but you would need to store the key that makes the codes.
[ Parent | on HN ]
Re:Aegis Authenticator – Open-source 2FA for Android by m-p-3 on Sunday January 17, 2021 @02:00AM (#25808777)
If it's secured by TOTP and a unique and secure password, it's not the weakest link.
[ Parent | on HN ]
Re:Aegis Authenticator – Open-source 2FA for Android by chromakode on Sunday January 17, 2021 @03:31AM (#25809163)
This reduces the attack scope from two devices to one. If your computer or web browser is compromised then both your TOTP secrets and password secrets are in one basket. Storing TOTP on a separate device can make it significantly harder to compromise your accounts.
[ Parent | on HN ]
Re:Aegis Authenticator – Open-source 2FA for Android by literallycancer on Sunday January 17, 2021 @07:27AM (#25810173)
He might be using two different password manager accounts, one for passwords and one TOTP? Although it doesn't help much if he logs in from the same machine anyway.
[ Parent | on HN ]
Re:Aegis Authenticator – Open-source 2FA for Android by Denvercoder9 on Sunday January 17, 2021 @04:39AM (#25809441)
Partially, but it still offers protection against e.g. replay attacks and e-mail hacks.
[ Parent | on HN ]
Re:Aegis Authenticator – Open-source 2FA for Android by cdurth on Sunday January 17, 2021 @02:14AM (#25808859)
I would say not when you can secure bitwarden with a hardware key 2FA.
[ Parent | on HN ]