I often see how people make security decisions based on pure intuition. Can I store TOTP in my password manager? Should I use a local password manager or is a remote one OK? Is it OK to configure multiple second factors? Since I have a degree in Information Security 🤓, I think I’ll try to clarify these questions by describing the underlying theory, so you’ll have a decision framework to make educated choices.
This sentence seems to contradict the earlier ones about convertibility.
Why? You can convert between factor forms, but you can’t add extra ones.
Well, earlier you wrote:
The paper can then be put into a safe, thus becoming a 2FA secret
If the file is stored only on your local disk, it’s 2FA, congratulations!
… both of which seem to be talking about adding a second password to get 2FA.
I don’t agree that TOTP is a password you don’t know, because you can’t write it down.
Sure you can, otpauth URIs and QR codes are a thing. A TOTP code is just a shared secret, the only difference from a non-memorized password is the authentication protocol. (Ignoring the user interface fluff.)
A collection of TOTP codes is just as knowable as a collection of passwords generated by a password manager, ie, impossible. They are all a possession factor if they are held in an offline password manager.
Well, earlier you wrote:
… both of which seem to be talking about adding a second password to get 2FA.
Sure you can, otpauth URIs and QR codes are a thing. A TOTP code is just a shared secret, the only difference from a non-memorized password is the authentication protocol. (Ignoring the user interface fluff.)
A collection of TOTP codes is just as knowable as a collection of passwords generated by a password manager, ie, impossible. They are all a possession factor if they are held in an offline password manager.
score 1 · canonical