Open Source

31088 readers

765 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Posts must be relevant to the open source ideology
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago

MODERATORS

[email protected]

Dedicated Authenticators from Password Manager vendors (sh.itjust.works)

submitted 8 months ago by [email protected] to c/[email protected]

17 comments fedilink hide all child comments

Does anyone know why there are no dedicated Authenticator apps made by for example Proton or Bitwarden?

I’m aware that they have TOTP baked into their password managers but you still need to have at least one separate solution to log into your vault.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 6 points 8 months ago (1 children)

Because if - if - your master password database gets breached, having your TOTPs in a separate vault is the difference between

Shit, they got into my stuff which doesn't support TOTP

and

Shit, they got into everything

[–] [email protected] -1 points 8 months ago* (last edited 8 months ago) (1 children)

No. If anyone has access to your email or master password, they can simply reset any other account. How would your difficult (one time used) password of protonmail be leaked? Proton doesn't have it. Only if you've got powerful malware on your device and then it doesn't matter in which app your shit is stored.

[–] [email protected] 6 points 8 months ago* (last edited 8 months ago) (1 children)

What? No. That depends on the site in question. If you have 2FA, the site should not let you reset your password without that 2FA - it's one of the major points of even having 2FA. If a website lets you reset your password without the multifactor auth you set up, they're doing it wrong.

Edit: to be clear, we're talking about having your multifactor auth in the same vault as you keep your passwords. That's fine to do as long as your vault doesn't get breached. If you do get breached, having your TOTP secrets in a different vault will help keep at least some of your accounts safe.

[–] [email protected] 3 points 8 months ago* (last edited 8 months ago)

I think they are suggesting the abality to reset 2fa for a service if they have access to your email.

Let's say your database contains your email service, and bank account without 2fa. Let's also assume they got acess to your email through a sham site that had you type credentials in and 2fa.

Hacker gets database.

They can login into your email and use the recovery code the bank send to your email for "lost my 2fa". (And delete the mail notifications as they come in, hopefully before you catch on)

A bank (should) have additional steps such as phone number, or a real recovery key you were supposed to write down, but a random online store or entertainment site will probably will just reset the 2fa and the hacker can go from there.

Realsisticlly we should be using at least 3 password database files with different master passwords for better security.

Account logins and passwords
TOTP
Any 2fa recovery keys.

However in practice, that is a pain in the ass and if someome has taken the time to breach your 1 specific database instead of going after easier targets, they probably have all your databases.