Re:Aegis Authenticator – Secure 2FA App for Android
by howinteresting on Wednesday November 02, 2022 @02:52PM
(#33441071)
2fa for your password manager is good, but that doesn't have to be TOTP. That can just as well be something like the 1password secret key (something you have).
Re:Aegis Authenticator – Secure 2FA App for Android
by plumeria on Wednesday November 02, 2022 @03:47PM
(#33441925)
I think that's the idea behind using a key file and a password in KeepassXC.
Re:Aegis Authenticator – Secure 2FA App for Android
by unethical_ban on Wednesday November 02, 2022 @03:21PM
(#33441523)
The one place I intentionally don't have TOTP is my password manager.
there is a base case somewhere in a backup strategy where TOTP is not feasible. The base case for me is "Keepass file backed up to multiple locations and my master key written down in an envelope in my house in case I hit my head".
Why would I lock my passwords away behind a TOTP that can get lost? My TOTP in Authy is protected by a long random key. Where do I store the key? In my password manager.
You can't use a password manager and TOTP to back each other up.
Re:Aegis Authenticator – Secure 2FA App for Android
by arepublicadoceu on Wednesday November 02, 2022 @03:32PM
(#33441678)
I realise now that I was not clear on my post. Using TOTP or second factor is useful for those heathens that insist in using cloud based service for password manager (I'm one). Not for local keepass/pass synced by syncthing/rsync/ssh etc.
I treat my kdbx as a single password encrypted backup of my bitwarden vault on my computer and external hard-drive.
I care much less about second factor if it's something offline on my computer than something accessible by a web interface to anyone in the world.
Re:Aegis Authenticator – Secure 2FA App for Android
by atriix on Wednesday November 02, 2022 @07:26PM
(#33444280)
Well my password manager don't have an account to begin with, neither does my TOTP manager. And depending on risk assesment for a given site/account, letting the password manager do some doubble duty as TOTP manager as a convinience is fine, especially if the alternetive outcome would be to not enable TOTP due to the annoyance.
Besides, if you dont have a physical and digital backup of your TOTP seeds you really like to live dangerously.