News for hackers. Stuff that matters.
Re:Why even let users set their own passwords? by nvahalik on Saturday July 22, 2023 @10:54AM (#36826728)
He also claims that TOTP storage in the password manager is useless. It's only useless if the entire password manager is compromised. If your attack vector is a keystroke logger, or compromise of a single password via a dump, or even someone having written down the password... storing the TOTP is still effective.
Re:Why even let users set their own passwords? by sjadoinqwoeihad on Saturday July 22, 2023 @11:15AM (#36826934)
Keylogger would still get the TOTP code. Dump would include the TOTP secret. Why write only the password down if you still need password manager for the TOTP code?

I think I mostly agree TOTP in password manager is useless, but it's not worse than not having TOTP at all so it's whatever.

Re:Why even let users set their own passwords? by orev on Saturday July 22, 2023 @11:35AM (#36827111)
A TOTP code must be marked as “used” immediately after processing it, so an attacker using a keylogger would have only a few seconds at most to use the code, assuming the user typed the code from the password manager instead of copy/paste.

The protection offered for TOTP in a password manager is from people who reuse the same password on multiple sites and some other site gets hacked. In that case, the attacker would not be able to login, regardless of having the password.

Also, once a system is so thoroughly compromised that the attacker can install a key logger or dump a password database, that system and all the user accounts are already completely compromised.

TOTP at this point is essentially a forced password that changes every 30 seconds instead of an actual additional factor, however in many cases that’s good enough.

Re:Why even let users set their own passwords? by jiveturkey on Saturday July 22, 2023 @03:20PM (#36828965)
you missed the attack. a keylogger doesn’t capture the TOTP (and fully synchronous 0-reuse TOTP isn’t possible on global scale, instead you catch it in audit) a keylogger captures the master password to the pwm that stores the TOTP secret.
Re:Why even let users set their own passwords? by r00fus on Saturday July 22, 2023 @06:16PM (#36830495)
But then they have to have physical access to your pwm or an export of it. If it's cloud-based, I'd have to assume there's some additional auth done for non-approved devices, or it's a bad cloud pwm.
Re:Why even let users set their own passwords? by kemayo on Saturday July 22, 2023 @11:36AM (#36827115)
In the keylogger case, it still makes the attack more complicated -- they need to steal your login before that code expires, so rather than passive password-harvesting it has to be an immediate attack.
Re:Why even let users set their own passwords? by ghusto on Saturday July 22, 2023 @02:47PM (#36828687)
2FA protects two different attacks: 1) Hacker obtaining your password (through phishing, compromise of third party, etc.) 2) _You_ actually being compromised yourself somehow.

It is still effective for the first protection if you store your codes in your password manager, but less for the second. I say less, and not completely, because if your machine is compromised, gaining access to your phone too is only a matter of time. Of course this can be mitigated why proper hardware tokens, but most people aren't using those.

Re:Why even let users set their own passwords? by r00fus on Saturday July 22, 2023 @06:14PM (#36830480)
Keylogging + dump of password manager requires 2 different but related compromises, no?

Ultimately if someone can log keystrokes and has access to your device, it's game over.