lobsters score: 8 · tags: security
I like the ideas in this article but I found it a bit frustrating to read: it’s not very consistent about the 2FAness of a password store, especially in the introductory sections.
I think, in common with a lot of discussions of passwords, it doesn’t consistently distinguish between passwords that you do know and passwords that you don’t know. A TOTP key is a password you don’t know, passwords generated by password managers are passwords you don’t know. But you do know your login password and your password manager decryption password.
The other issue is whether a password store is a “something you have” factor or not. The discussion about online vs offline password managers towards the end is good but it’s unclear earlier on. I like the idea of modelling an offline password store as something only you posess, and an online password store as something anyone has.
Examples of inconsistency:
A password can be written down on a piece paper, thus becoming a possession factor. The paper can then be put into a safe, thus becoming a 2FA secret
This implicitly assumes you don’t know the password, so you can’t use it without referring to the paper.
a TOTP key can be put in a password manager. If the password manager is protected only by a password, the secret becomes knowledge-based.
… assuming the password manager is online, not like a safe.
If you put a password behind another password or pass phrase, it remains a knowledge-based secret. However, reading it also requires access to the encrypted file. If the file is stored only on your local disk, it’s 2FA, congratulations!
Same as the safe argument: assumes you don’t know the first password, fine; explicit about the safe-like password manager, good. But it seems to contradict the earlier paragraph about storing a TOTP key in an unspecified kind of password manager, especially if the reader is not savvy enough to realise (before you explained it) that there are two kinds of password manager.
there’s no way a password manager can turn 1FA into 2FA.
This sentence seems to contradict the earlier ones about convertibility.
storing TOTPs there is a malicious functionality, and should not be used for anything critical
A TOTP is just a password you don’t know, plus a load of interaction design that encourages users to store them as something they (and only they) have. I think if someone understands the know/have distinction and is careful about who has their password store, they are well informed to choose where to keep TOTP keys.
score 4 · canonical
Thank you for the comment! In the article I tried introducing one idea at a time, so the earlier sections unfortunately turned out to be less precise, since I was concentrating on the basics. I’ll try to improve them somehow.
About distinguishing between passwords that you do know and passwords that you don’t know: it’s a difficult topic, because they kinda flip between knowledge and possession forms based on your role: if you’re a defender, you’d probably consider it a possession (you can’t enter it without referencing something), but for an attacker it’s knowledge (no difference from a user-known password). I prefer to think from the attacker’s perspective, so it’s mostly a knowledge factor to me.
there’s no way a password manager can turn 1FA into 2FA.
This sentence seems to contradict the earlier ones about convertibility.
Why? You can convert between factor forms, but you can’t add extra ones. A password manager stores secrets behind 2FA, but the systems those secrets are from are still 1 or 2FA, regardless of the password manager usage. I should add it more explicitly to the post, indeed it’s not clear 🤔
I don’t agree that TOTP is a password you don’t know, because you can’t write it down. It’s a password you can’t know. Yes, there’s a token used to generate TOTPs, but it’s almost never presented to a user, and they can’t remember it. It’s almost impossible to turn TOTP into a knowledge-based factor, unless you put it into your online password manager with 1FA (which I’m trying to discourage). So, I’m strongly considering TOTP as a possession factor (unlike regular passwords).
Thanks again for your notes, I’ll update the post 🙏
score 1 · canonical
This sentence seems to contradict the earlier ones about convertibility.
Why? You can convert between factor forms, but you can’t add extra ones.
Well, earlier you wrote:
The paper can then be put into a safe, thus becoming a 2FA secret
If the file is stored only on your local disk, it’s 2FA, congratulations!
… both of which seem to be talking about adding a second password to get 2FA.
I don’t agree that TOTP is a password you don’t know, because you can’t write it down.
Sure you can, otpauth URIs and QR codes are a thing. A TOTP code is just a shared secret, the only difference from a non-memorized password is the authentication protocol. (Ignoring the user interface fluff.)
A collection of TOTP codes is just as knowable as a collection of passwords generated by a password manager, ie, impossible. They are all a possession factor if they are held in an offline password manager.
score 1 · canonical