1 yr. ago • 100%

Michael Tsai Blog - Is It Safe to Store Passwords and 2FA Codes Together?

https:// mjtsai.com /blog/2023/07/07/is-it-safe-to-store-passwords-and-2fa-codes-together/

18 comments

Permanently Deleted

16
There’s a balance between convenience and security and IMO storing both on 1Password is fine. An attacker getting into your 1PW account would require them having

your username

and your password (which should be unique to only 1PW)

and your secret key

or physical device access with your 1PW password or biometric auth credentials

in which case an attacker really wants your stuff, has your device, and you have bigger issues.

I feel like this is similar to saying “is your front door lock strong enough?” when a thief is at your door and really wants to get inside, regardless of level of effort required.
8
I feel like that defeats the purpose of 2fa.

5
- I agree for the most part but it doesn't entirely defeat the purpose. If someone got a hold of your password for a website it would still protect you. And let's be honest, that's the most likely scenario. But yes if someone got into your password manager then it's completely game over. A scenario where having a separate 2fa device would still protect you.
  
  6
- It defeats the purpose in the scenario that your vault is stolen and decrypted. But it still protects you in the much more likely scenario that a data breach exposes your password somewhere else.
  
  2
- It definitely defeats the purpose. If you store them together there’s only one factor!
  
  Things you know, have, or are.
  
  It just becomes two things you know.
  
  -1
  
  Password managers do have two factors: the vault (have) and the master password (know).
  
  4
Permanently Deleted

5
How hard is it to use a separate password manager and MFA app? I personally don’t keep any MFA codes in keychain because it’s not convenient to retrieve the passcode in most cases.

3
- You're posting this on an Apple forum so I have to ask: how is not convenient? If you use iCloud Keychain + Safari everywhere, it's ridiculously convenient. I went through some contortions in order to migrate my Symantec VIP codes to iCloud Keychain just so I could have that sweet code integration.
  
  1
  
  I can’t use my 2FA codes on devices that aren’t connected to my Apple ID, my work devices use Apple Business Manager apple IDs. I have a PC I use for Sony Vegas, etc.
  
  2
I don’t know, the article summed it up perfectly. Of course, I do it anyway. If someone steals and decrypts my laptop, and decrypts my password vault, they’ve earned the contents of my bank account.

1
- as one of the comments on that post said, even easier is they just call the bank pretending to be you and get them to reset your password. they don't need any of your devices or vaults in that case, just some easily discovered personally identifying info (which was probably leaked in a data breach)
  
  1

You've viewed 18 comments.