I often see how people make security decisions based on pure intuition. Can I store TOTP in my password manager? Should I use a local password manager or is a remote one OK? Is it OK to configure multiple second factors? Since I have a degree in Information Security 🤓, I think I’ll try to clarify these questions by describing the underlying theory, so you’ll have a decision framework to make educated choices.
Thank you for the comment! In the article I tried introducing one idea at a time, so the earlier sections unfortunately turned out to be less precise, since I was concentrating on the basics. I’ll try to improve them somehow.
About distinguishing between passwords that you do know and passwords that you don’t know: it’s a difficult topic, because they kinda flip between knowledge and possession forms based on your role: if you’re a defender, you’d probably consider it a possession (you can’t enter it without referencing something), but for an attacker it’s knowledge (no difference from a user-known password). I prefer to think from the attacker’s perspective, so it’s mostly a knowledge factor to me.
there’s no way a password manager can turn 1FA into 2FA.
This sentence seems to contradict the earlier ones about convertibility.
Why? You can convert between factor forms, but you can’t add extra ones. A password manager stores secrets behind 2FA, but the systems those secrets are from are still 1 or 2FA, regardless of the password manager usage. I should add it more explicitly to the post, indeed it’s not clear 🤔
I don’t agree that TOTP is a password you don’t know, because you can’t write it down. It’s a password you can’t know. Yes, there’s a token used to generate TOTPs, but it’s almost never presented to a user, and they can’t remember it. It’s almost impossible to turn TOTP into a knowledge-based factor, unless you put it into your online password manager with 1FA (which I’m trying to discourage). So, I’m strongly considering TOTP as a possession factor (unlike regular passwords).
Thanks again for your notes, I’ll update the post 🙏
This sentence seems to contradict the earlier ones about convertibility.
Why? You can convert between factor forms, but you can’t add extra ones.
Well, earlier you wrote:
The paper can then be put into a safe, thus becoming a 2FA secret
If the file is stored only on your local disk, it’s 2FA, congratulations!
… both of which seem to be talking about adding a second password to get 2FA.
I don’t agree that TOTP is a password you don’t know, because you can’t write it down.
Sure you can, otpauth URIs and QR codes are a thing. A TOTP code is just a shared secret, the only difference from a non-memorized password is the authentication protocol. (Ignoring the user interface fluff.)
A collection of TOTP codes is just as knowable as a collection of passwords generated by a password manager, ie, impossible. They are all a possession factor if they are held in an offline password manager.
Thank you for the comment! In the article I tried introducing one idea at a time, so the earlier sections unfortunately turned out to be less precise, since I was concentrating on the basics. I’ll try to improve them somehow.
About distinguishing between passwords that you do know and passwords that you don’t know: it’s a difficult topic, because they kinda flip between knowledge and possession forms based on your role: if you’re a defender, you’d probably consider it a possession (you can’t enter it without referencing something), but for an attacker it’s knowledge (no difference from a user-known password). I prefer to think from the attacker’s perspective, so it’s mostly a knowledge factor to me.
Why? You can convert between factor forms, but you can’t add extra ones. A password manager stores secrets behind 2FA, but the systems those secrets are from are still 1 or 2FA, regardless of the password manager usage. I should add it more explicitly to the post, indeed it’s not clear 🤔
I don’t agree that TOTP is a password you don’t know, because you can’t write it down. It’s a password you can’t know. Yes, there’s a token used to generate TOTPs, but it’s almost never presented to a user, and they can’t remember it. It’s almost impossible to turn TOTP into a knowledge-based factor, unless you put it into your online password manager with 1FA (which I’m trying to discourage). So, I’m strongly considering TOTP as a possession factor (unlike regular passwords).
Thanks again for your notes, I’ll update the post 🙏
score 1 · canonical
Well, earlier you wrote:
… both of which seem to be talking about adding a second password to get 2FA.
Sure you can, otpauth URIs and QR codes are a thing. A TOTP code is just a shared secret, the only difference from a non-memorized password is the authentication protocol. (Ignoring the user interface fluff.)
A collection of TOTP codes is just as knowable as a collection of passwords generated by a password manager, ie, impossible. They are all a possession factor if they are held in an offline password manager.
score 1 · canonical