News for hackers. Stuff that matters.

A comment on Lastpass Security Incident. Parent comment

Re:Lastpass Security Incident by lxgr on Wednesday November 30, 2022 @09:48PM (#33811702)
Only very marginally so. Or what would you say storing a (unique, long) password next to a TOTP hash actually achieves?
[ Parent | on HN ]
Re:Lastpass Security Incident by sceutre on Wednesday November 30, 2022 @10:38PM (#33812045)
Well the totp (even in your passwd manager) defends against phishing I'd thought vs password alone.
[ Parent | on HN ]
Re:Lastpass Security Incident by lxgr on Thursday December 01, 2022 @09:40AM (#33816791)
For a "service based" password manager, sure. (It can prevent the service from ever handing over your encrypted database to an attacker.)

In a local password manager, it doesn't work like that. A challenge-response mechanism can help there, but the cost/benefit analysis looks pretty different there, IMO.

[ Parent | on HN ]