[8cvor6j844qw_d6]

> Strong support for the strategy of not putting your TOTP/MFA in your password manager

Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place.

Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device.

A password manager + built-in TOTP on a dedicated device is fine for most general usage. Important TOTPs can go to Yubikeys.

[14u2c]

>Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place.

That seems somewhat unrealistic? There are many passwords you need to use as part of dev work.

[tedd4u]

One could perhaps put those in a different vault. Sounds like a pain to me. But nothing compared to an email and/or banking compromise.

[bartread]

It becomes tricky when all your passwords are randomly generated, 24 characters long, full of symbols, special characters, casing variations, etc. All of mine are an absolute nightmare to type manually.

I suppose that becomes a pretty strong argument for passphrases + MFA, because passphrases are much easier to type in manually. But the problem there is lots of services still have stupid/arbitrary maximum password length restrictions that make it difficult or impossible to use a sufficiently complex passphrase.

It’s very frustrating.

[bigiain]

You can generate "pronounceable" passwords in some tools.

1PW just generated this for me: mimp-rort-jan-mon-kain-sqin

Not as much entropy as 24 random letters/digit/punctuations/capitalisation. But (for me at least) much easier to read end type in situations where copy/paste isn't available (like from my phone to my dev docker containers)

[dbmnt]

Yes but parent was saying use passphrases, which is the same, just more like "correct horse battery staple". Parent then correctly pointed out there are a large number of sites that enforce special characters, numerical digits, etc., also being part of the password. So that idea falls apart very quickly in practice.

[ponector]

>> mimp-rort-jan-mon-kain-sqin And then you see they are not accepting such a weak password. Add special characters, numbers, etc.

[schrodinger]

That’s a good point.

Maybe a good compromise is to use 1pw for most TOTP but keep your gmail / iCloud and a few others in an iPhone only app?

Gmail is what scares me the most. It’s basically keys to the kingdom.

[everybodyknows]

> Gmail

We might all do well to remind F&F to print out account recovery codes, and then put some thought into where they'll be safe.

[frantathefranta]

I settled on that after trying to be extra careful with TOTP. Now my split is 95% of passwords, TOTP codes and passkeys in 1Password, 5% (really important stuff like email) in an offline KeePass DB + passkeys on Yubikeys.

[deepsun]

But it's a hassle to have at least 2 yubikeys in case you lose one. And since you regularly sign up for new websites with OTPs, gotta keep them in sync. So always carry both with you. And if you carry both, then it's easy to lose both at the same time.

UPDATE: also gotta keep track separatelt of non-resident passkeys tied to Yubikey, because Yubikey doesn't know where it was used for non-resident. If you lose one yubikey, need to sync all passkeys to a new replacement one.

[cuu508]

I add a note in the password manager's notes field for sites where I've added Yubikeys as the second factor. I can get the list of the sites using search, and from time to time I go through them to check if a backup key needs to be registered. I create new accounts infrequently.

[zygentoma]

Would be nice if you could get an exact clone of a yubikey, so you always have a spare in case you lose one.

Though I think there is also the option that sites can store some sort of identifier on the key, then this would not work:/

[captn3m0]

> I don't think there exist a password manager that is explicitly designed for a compromised/hostile device.

The crypto people tried this with hardware only password managers but they were too annoying. I have a halfway solution of using pass with Yubikey/GPG where each password decryption requires a touch. It does protect against the entire vault being decrypted at once and exfiltrated.

[embedding-shape]

> tried this with hardware only password managers but they were too annoying

And besides that, ultimately if the computer you're using been compromised, whatever you do on that computer can be mucked about with, so while the password sits safely on the hardware, once you're logged in in the browser, the cookie is just sitting there. I guess you'd get furthest isolation with Qubes et al, but with a regular Linux installation you'd still be exposed with a hardware password manager, if the installation been compromised.

[embedding-shape]

> Agreed, but I think using the same device to access your password manager and for dev

Almost all development I do, and most others, are on our projects or projects we're at least interested in, and most likely dove into, that's why we're developing in them in the first place.

In this case, it seems like the developer wasn't actually developing anything, but playing around with image generation on his time off, for fun, and ended up pulling down a random 3rd party thing and got compromised that way. Very different from "for dev" I'd say.

Besides, didn't most developer start isolating projects from each other when the first npm worms started to appear? I know I stopped running `npm install` in the same environment I do my banking, and drastically reduced the amount of random 3rd party stuff I have, still use all the same device though. Even have a Windows install on the same computer, booo!

[bigiain]

> Important TOTPs can go to Yubikeys.

Once you have a Yubikey (preferably two, so you have a backup if you damage/lose one) - you may as well make _that_ your primary MFA method, and only use TOTP for services you can't enrol your Yubikeys on.