Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?

  • ddnomad@infosec.pub
    2910·
    1 year ago

    Please don’t use your password manager for TOTP tokens. It is called two factor authentication for a reason.

    • beeb@lemm.ee
      33·
      1 year ago

      The reason that 2fa exists is not to protect you if someone gets their hands on your device. It’s to protect you if your “static” credentials leaked from a providers’ database or you otherwise got phished. Using a password manager to handle mfa is totally reasonable.

      • 4am@lemm.ee
        10·
        1 year ago

        If you are really worried about the password manager being an intrusion vector, secure your vault with a hardware key.

        • Acters@lemmy.world
          41·
          1 year ago

          You can be paranoid and split the two, but most people(99%) will be perfectly fine with KeePass.

      • ddnomad@infosec.pub
        1·
        1 year ago

        It is reasonable yet subpar under a threat model where you do not trust any single provider, which is a model I find appropriate most of the time.

      • Amju Wolf@pawb.socialEnglish
        1·
        1 year ago

        There are other ways your password database could leak. For example you could use a weak password, or it could leak in some way, and if you store it on a cloud service that also got compromised you’d be fucked without a compromised device.

        But yeah, all these are much less likely.

    • PrincipleOfCharity@0v0.socialEnglish
      24·
      1 year ago

      I feel like this needs to be pushed back on a little bit. Don’t let perfect be the enemy of the good. Having a password manager that provides good passwords and TOTP as a second factor is way better than only using a password.

      Sure, it would be nice if you had two devices. A phone password manager and a usb security key, but for many people it is inconvenient to carry a security key to plug when you need it. I’d rather that person keep a TOTP on their phone in that case rather than not use two factor due to inconvenience.

      Your concern is mostly about “what if someone steals your phone or computer” then they have both factors. However, your average person isn’t getting hacked by someone they know, and random local thieves aren’t typically sophisticated enough to do more than re-sell stolen computer equipment. The average person is getting hacked by some dude in a foreign country who dumped a password database or phished a password. That person isn’t stealing your device so the fact that both factors are in the same place doesn’t really mean anything.

      Also, most password managers are locked by biometrics these days. In that case, it isn’t really the app that is the second factor. It is your fingerprint or face. Someone may steal your device, but if they can’t get into the password manager that needs a password and biometrics then they don’t have anything.

      • umami_wasabi@lemmy.ml
        5·
        1 year ago

        Except Steam and banks that are stubborn and insist to use a custom implementation rather a standard one.

        • VonReposti
          1·
          1 year ago

          The Danish ID solution actually offers the possibility to use FIDO U2F. Unfortunately the requirements were to provide the option and not how to provide it, so you have to purchase their “special” key since you can’t use your own Yubikey even though it’s the same hardware…

    • auth@lemmy.ml
      2·
      1 year ago

      I do that mainly for accounts I don’t care about but either way it does increase security as compared to just a password in many cases… I just wish that some of these services didn’t require TOTP