Hacker News new | ask | show | jobs
by LeoPanthera 716 days ago
If your 2FA code is as autocompletable as your password, is it really a second factor?
5 comments

I personally don't think so. It's something you know + something you have with you.

If your computer is compromised, the 2FA should be somewhere else, not in a keychain.

This is why I like Yubikey and other forms of 2FA (phone based TOTP, mostly).

Yes — because 2FA is commonly stored on a separate device (phone), people are very quick to conclude that it is pointless otherwise without thinking further.

Even if it is stored in your password manager, it is still useful. Consider the case where your network or website is compromised: the password is compromised and can be reused, but the totp 2fa that is in your password manager still prevents login by anyone who obtained your password. There are many attack scenarios but storing 2fa and enabling autocomplete definitely does not make it useless.

Also I'm sick and tired of every business thinking that a phone has to be the second factor.

A laptop, or even better, a large, immobile desktop PC, is a much better second factor than a phone, and there is no reason why a user should be forced to go find their phone when they have console access to a much larger device.

Putting a Yubikey semi-permanently on every device and having you do a one-time registration of each device (initially using another already-registered device) should be the default way of implementing 2FA.

But what if it is an app on the phone that is asking for that 2FA which then receives that 2FA via text?
2FA code (rng seed) can be stored to password managers directly as well.

It is access requirement for something else, which fulfills the criteria of 2FA.

In this case, there is requirement to access the browser and phone.

But if you have it in the PW manager, isn’t it moot?

I guess it’s still safe against leaking of your password only.

Yes, you're completely right.

It depends on your threat model vs usability/ease of use.

OK, so it's a passkey for sites that don't support passkeys. I'm fine with that.
Possibly. But this appears to be for SMS-based 2 factor, so you'll need your phone nearby.