Hacker News Reader

Comment by dastx | Hacker News Reader

Is there a reason people don't use their password manager for OTP? In my case I'm using 1Password, which supports OTP but I know most other password managers support it too including clients for Keepass.

I guess there is the issue of your password manager being compromised but honestly I'm way less worried about that than website x or y getting compromised.

View on HN

It isn't much of a second factor if it is the same factor as your password.

But the point it protects against is if a website a password belongs to is compromised. If your password manager is compromised, then yes, it is game over. But by that logic, if your password manager and your otp manager is compromised (which often live on the same phone) you haven't mitigated much.

You can make an argument for a second factor (other than hardware key) being of fairly little value to anyone using an offline password manager and generating passwords with a huge amount of entropy.

I don't think this is entirely true, and so I often use TOTP with important sites. But I'm okay with storing the TOTP key in my password manager (which encrypts the password database with a long key phrase and a key file). Even on top of the very little chance that any of my long passwords are going to get leaked or broken, I think the chance that this happens because my password manager gets hacked along with the TOTP keys (as opposed to me getting phished or a vulnerability in a website) is pretty remote.

I used to do that for the convenience of the autofill but my paranoia got the best of me. If someone got access to my 1password he could access all my accounts, which defeats the purpose of two factor authentication. It turns out that with the shared copy/paste feature between Mac and iOS, using a phone app isn't such a hassle.

i totally agree. at the same time, my phone has ~15 2FA accounts right now.

if lose my phone, i can't access any of them. if i change my phone, it will take me hours and hours to change every single one of those accounts.

there must be a middle ground between those two.

Export your 2FA from Aegis and import into new phone. That's the main reason I switched.

I use keepassXC on desktop, and Kypass on iOS. They both support OTP, but in different formats, which messes up my syncing of the database via Nextcloud, so I use Authy on iOS.

Reply on news.ycombinator.com