Why do password managers charge for TOTP code generation?
Why do password managers charge for TOTP code generation?
Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?
You're viewing a single thread.
Please don’t use your password manager for TOTP tokens. It is called two factor authentication for a reason.
The reason that 2fa exists is not to protect you if someone gets their hands on your device. It's to protect you if your "static" credentials leaked from a providers' database or you otherwise got phished. Using a password manager to handle mfa is totally reasonable.
If you are really worried about the password manager being an intrusion vector, secure your vault with a hardware key.
Agree. That's another reason to always suggest KeePass!
You can be paranoid and split the two, but most people(99%) will be perfectly fine with KeePass.
It is reasonable yet subpar under a threat model where you do not trust any single provider, which is a model I find appropriate most of the time.
There are other ways your password database could leak. For example you could use a weak password, or it could leak in some way, and if you store it on a cloud service that also got compromised you'd be fucked without a compromised device.
But yeah, all these are much less likely.
I feel like this needs to be pushed back on a little bit. Don’t let perfect be the enemy of the good. Having a password manager that provides good passwords and TOTP as a second factor is way better than only using a password.
Sure, it would be nice if you had two devices. A phone password manager and a usb security key, but for many people it is inconvenient to carry a security key to plug when you need it. I’d rather that person keep a TOTP on their phone in that case rather than not use two factor due to inconvenience.
Your concern is mostly about “what if someone steals your phone or computer” then they have both factors. However, your average person isn’t getting hacked by someone they know, and random local thieves aren’t typically sophisticated enough to do more than re-sell stolen computer equipment. The average person is getting hacked by some dude in a foreign country who dumped a password database or phished a password. That person isn’t stealing your device so the fact that both factors are in the same place doesn’t really mean anything.
Also, most password managers are locked by biometrics these days. In that case, it isn’t really the app that is the second factor. It is your fingerprint or face. Someone may steal your device, but if they can’t get into the password manager that needs a password and biometrics then they don’t have anything.
That's why I had my fingertips removed and stored in a secure location. If your fingers are still attached to your body, that's just like 1FA
Just wait until you learn that if you are going to use removed finger-tips then they don’t necessarily have to be your own…
Uhhhh ... c/unethicalLPT?
You should not assume your password manager is unhackable.
That’s my main point. Perfect is an enemy of good indeed, but I feel that doing things properly the first time is a good idea in general, especially when it as easy as using a different app for your TOTP tokens. It’s a low hanging fruit really.
Permanently Deleted
Except Steam and banks that are stubborn and insist to use a custom implementation rather a standard one.
Yep, for some reason Valve and the incessant Steam fanboys insist that mobile-based Steam Guard is absolutely perfect and anything like U2F just makes things more insecure… somehow.
Fortunately, Bitwarden at least implemented Steam’s own TOTP algorithm. With a very user unfriendly process you can grab the authenticator key Steam gives you via the third party Steam Guard desktop client, insert it into Bitwarden, and then it’ll happily generates the right verification codes for you.
The Danish ID solution actually offers the possibility to use FIDO U2F. Unfortunately the requirements were to provide the option and not how to provide it, so you have to purchase their "special" key since you can't use your own Yubikey even though it's the same hardware...
I do that mainly for accounts I don't care about but either way it does increase security as compared to just a password in many cases..... I just wish that some of these services didn't require TOTP