Hacker News new | past | comments | ask | show | jobs | submit login

If the password manager was compromised (not accessed without permission, but updated without permission) then it wouldn't be just the single TOTP value that leaked, it would be the underlying key.

On a mobile device you might be a bit limited in how "distant" you can keep the two, since the vendor is typically almighty in that scenario. But in general, you have options and you might as well avoid keeping both eggs in the same basket.




That's one vector of my "not quite as secure as it could be" statement was thinking about. Or of someone just managed to steal your phone and break into it.

But, there are still other attacks that this setup protects against.

Two-factor isn't "two device", two factor is two factors of authentication, where factors are generally:

* something you know (password) * something you have (key handshake, totp generator) * something you are (biometrics)

Storing your TOTP secrets next to your hard passwords is putting eggs in the same basket, I agree. But I'd prefer someone do this than just forego adding TOTP or multi-factor entirely.

And in the end, even if you used two different apps on your phone you're still putting all your eggs in the same basket, which is a trade off tons of people are going to do. Even a lot of very security-conscious users will end up with some TOTP app and a separate password manager, chances are both apps will be installed on the same device. If that device gets thoroughly compromised there's potential for both apps to be attacked and compromised.

If your OS vendor shipping malicious code is a realistic threat to you, or at least attackers being able to impersonate your OS vendor, you're probably going to end up getting compromised even if you split it out into two apps. You'd probably just want to avoid TOTP entirely and move to physical hardware cryptographic tokens.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: