Hacker News Reader

Comment by oefrha | Hacker News Reader

2FA with password manager is pretty much asking for trouble. Any compromise that is capable of leaking my master password can’t be stopped by a second factor.

View on HN

What do you mean? I need both my Yubikey and my password to log in to my password manager. If my master password gets leaked somehow, they still need my Yubikey, which is on my person at all times.

The CIA could infiltrate my house when I'm sleeping and steal my Yubikey, but any other idiot on the internet that wants my data has no chance, which is what I'm most concerned about.

To leak my master password, “any other idiot on the internet” needs to do one of four things: (1) backdoor my password manager; (2) install a keylogger to capture it while I’m typing it in; (3) somehow grab a copy of the encrypted database and crack it offline; (4) read my mind. (1) is game over; (2) with that level of access they can also steal everything while the password manager is unlocked; (3) with offline cracking, any 2FA protection just extends the password, and my master password is strong enough for any idiot on the Internet; (4) can’t defend against magic.

Sorry, I'm not sure I follow. First you say that 2FA is useless if someone gets your master password, which is wrong, now you argue that stealing a master password is very hard.

What exactly is your point?

I outlined all the scenarios where the master password can be stolen. In none of the scenarios does a 2FA offer additional protection.

Yes it does, because 2FA means you need BOTH the master password and the second factor device to log in. Stealing the password is not enough. That is the point of 2FA.

The point is in none of the scenarios 2FA isn’t compromised at the same time or is even needed (except in the offline cracking case, where cracking password + token is harder than cracking just password, but with a reasonable password both are practically impossible). Read again. Consider realistic attack vectors instead of repeating dogma.

2FA, especially hardware based 2FA protects you from scenarios that could involve leaking of your passwords (such as many common MITM attacks, phishing, spoofing) and makes cracking a DB incredibly hard for your average hacker if they somehow get their hands on it. And you would have to define a 'reasonable password' because I could guarantee what you consider reasonable is orders of magnitude easier to crack than a 2FA + password solution. It objectively reduces the amount of attack vectors to gain access to your accounts.

Calling it dogma when 2FA has known security advantages is just wrong.

I suspect they are thinking of TOTP-based schemes for 2fa, not hardware-based 2fa. With TOTP-based 2fa, you can store the seeds in your password manager, which ends putting them next to the passwords themselves, all in one place.

Reply on news.ycombinator.com