It's a convenience feature upsell, the calculations happen locally.
this post was submitted on 11 Sep 2023
52 points (100.0% liked)
Privacy
789 readers
3 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
That's just an excuse to charge more. TOTP is standardized in RFC 6238 and cost nothing to generate.
On top of that, it takes no more than 5 lines of Python code to generate
The "Product Led Growth" crowd doesn't care about charging based on what things cost. They only care about what the buyer will tolerate. The "value metric" that pisses me off the most is per user pricing when the service doesn't incur costs per user.
The “value metric” that pisses me off the most is per user pricing when the service doesn’t incur costs per user.
Even in cases where there is a cost per user (or there is at least a correlation in cost increase with number of users) the price is usually many orders of magnitude larger than the cost increase.
TIL password managers charge for 2FA.
- Get a free password manager.
- Get a free 2FA App. Please don't mix passwords and 2FA so you don't reduce it to 1FA.
For 1) I use PasswdSafe, because I can merge databases with Password Gorilla as I like.
For 2) I use Aegis. You can download an icon theme, which is quite cool.
For the 2nd point:
Mixing it doesn't reduce it to 1fa - it still makes your accounts immune to Passwort leaks and common attacks
You are only at a 1FA level if someone hacked your PW-Manager but in that instance you're most likely fucked anyway
Sure for the most important accounts having 2FA in another app is good so you can at least secure those if the PW-Safe leaked but I have 2FA on every single website I use(d) that offers it - even if I'm only on there once a year so using a special app is less important than just having the additional security in the first place
I usually call it 1,5FA since it is reduced to one factor, namely the password manager, but that password manager is protected by 2FA.
You are only at a 1FA level if someone hacked your PW-Manager but in that instance you’re most likely fucked anyway
As long as you at least have actual, separate 2FA for access to your recovery email(s) you should be more or less fine.
Unless you mean that if your password manager is compromised it probably means that your device is compromised, which also means that you're probably also a victim to a session hijack for the recovery email(s), in which case you are truly fucked.
You can also have a multi-level approach where for "higher value" accounts you have a separate password database so the more valuable accounts aren't exposed as much as everything else... There are definitely options.
Please don’t use your password manager for TOTP tokens. It is called two factor authentication for a reason.
The reason that 2fa exists is not to protect you if someone gets their hands on your device. It's to protect you if your "static" credentials leaked from a providers' database or you otherwise got phished. Using a password manager to handle mfa is totally reasonable.
If you are really worried about the password manager being an intrusion vector, secure your vault with a hardware key.
Agree. That's another reason to always suggest KeePass!
There are other ways your password database could leak. For example you could use a weak password, or it could leak in some way, and if you store it on a cloud service that also got compromised you'd be fucked without a compromised device.
But yeah, all these are much less likely.
It is reasonable yet subpar under a threat model where you do not trust any single provider, which is a model I find appropriate most of the time.
I feel like this needs to be pushed back on a little bit. Don’t let perfect be the enemy of the good. Having a password manager that provides good passwords and TOTP as a second factor is way better than only using a password.
Sure, it would be nice if you had two devices. A phone password manager and a usb security key, but for many people it is inconvenient to carry a security key to plug when you need it. I’d rather that person keep a TOTP on their phone in that case rather than not use two factor due to inconvenience.
Your concern is mostly about “what if someone steals your phone or computer” then they have both factors. However, your average person isn’t getting hacked by someone they know, and random local thieves aren’t typically sophisticated enough to do more than re-sell stolen computer equipment. The average person is getting hacked by some dude in a foreign country who dumped a password database or phished a password. That person isn’t stealing your device so the fact that both factors are in the same place doesn’t really mean anything.
Also, most password managers are locked by biometrics these days. In that case, it isn’t really the app that is the second factor. It is your fingerprint or face. Someone may steal your device, but if they can’t get into the password manager that needs a password and biometrics then they don’t have anything.
You should not assume your password manager is unhackable.
That’s my main point. Perfect is an enemy of good indeed, but I feel that doing things properly the first time is a good idea in general, especially when it as easy as using a different app for your TOTP tokens. It’s a low hanging fruit really.
load more comments
(3 replies)
I do that mainly for accounts I don't care about but either way it does increase security as compared to just a password in many cases..... I just wish that some of these services didn't require TOTP
load more comments
(4 replies)
It's free on KeePass, use syncthing to have personal libre cloud.
Keepassxc and macpass do it for free
If your password manager is charging for that get a new manager as almost all managers will do that for free
It's completely open and it's just another fee you can pay. Switch to KeePass if you want restriction-free password management.
If you like Bitwarden you might wanna search for a publicly hosted Vaultwarden instance that accepts user registrations. You'll get Bitwarden with its full premium feature set.
Not 100% on board with that idea. There is no guarantee the server is not tampered. Unless you know and trust the host, Bitwarden premium is very affordable and Vaultwarden can be hosted even on free VPS. Or you can even use a KeePass fork (I'm not up to date as to what the best ones are) with any form of online sync.
KeePassXC (windows/macos/linux), KeePassDX (android) are what I use. I sync the databases between 4 devices with Syncthing.
Thanks for the info! I'm a happy Bitwarden subscriber, but it's good to know.
What's the best free VPS? I pay about $15 per year for mine... But its good enough to run woocommerce/wordpress for a small store
Well, yes, I agree on that. Just wanted to name another option in case that's okay for the OP. I host my own instance on my private NAS and I absolutely love it. :)
If you are willing to host something yourself you might as well selfhost Nextcloud and use KeePass(XC) with it.
Keepassxc doesn't