Hacker News Reader

TOTP is based off of a shared secret, so keeping that secret backed up is possible. I keep all of my TOTP tokens in a keepass database that is synced to my computers. If my keepass database is ever stolen and the encryption defeated then I'd be hosed, but I have a feeling there would be much worse problems in the world on that day.

View on HN

Isn't the whole point of 2FA to keep you safe if your passwords get compromised? Seems like you may as well not bother with it.

I guess this means that any attacker will need to compromise your keepass database rather than just one of your other passwords, but it would help avoid a potential "hosed" scenario.

Maybe you think you're more likely to lose your phone then leak your master password? Perfectly reasonable I suppose :)

Passwords are sending secrets around. TOTP auth doesn't involve sending any secrets because the algorithm shouldn't be practically reversible.

My master password has hundreds of bits of entropy and only leaves my brain to enter it.

Most likely bad scenario is master password gets lifted from a keylogger and the database is stolen. I don't see what keeping the secrets in an app does to help that though.

Sounds about correct, but this setup provides adequate protection against phishing and MITM attacks. The KeePass database itself can be hardened with a 2FA token.

Reply on news.ycombinator.com