Closed kousu closed 3 years ago
This would still require an atacker to have access to the pass store, and not just the password, so while not safer than a separate OTP key, it's safer than not having anything.
It also depends on why you are using 2FA. If you're just using it to minimise the risk of logging into you accounts on public computers, it's totally valid to store the TOTP secrets on your own pc and e.g. your phone for mobile use.
Okay, I like the public-computer justification. Thanks. I think I can sleep a better :)
gopass
thinks: https://github.com/gopasspw/gopass/blob/master/docs/features.md#adding-otp-secrets
Note: Depending on your security needs, it may not behoove you to store your OTP secrets alongside your passwords! Look into Multiple Stores if you need things to be separate!
If you use an OpenPGP smart card (such as a YubiKey) then I suppose it effectively turns TOTP-supporting sites into FIDO U2F-supporting (not that actual standard obviously, but in effect) sites.
You 'have':
You 'know':
gpg-agent
knows it)(Just working this through for myself really - my initial reaction was the same, OP.)
This project essentially allows you to convert the OTP factor into another secondary factor, or remove it as you wish. I personally use a Yubikey to decrypt passwords, so OTP-based 2FA is redundant for me.
Turns out, Browserpass agrees with me!
That said, security is about tradeoffs. For most accounts, I'm far more fearful of getting locked out because I've broken my phone and lost my 2fa codes than I am worried about someone breaking into pass
. And having OTP on still protects me from someone who has stolen my site password in a data breach or through my negligence, but hasn't got my master password or pass
itself.
I find myself being extremely grateful for pass-otp
everytime I'm prompted with an annoying page nagging me for a code.
I like the elegance of this extension, but it's been bothering me more and more lately that this breaks the 2FA assumption most sites use TOTP for. While your password store is unlocked, any malware can steal your password AND TOTP code at the same time.
A safer way would at least require a separate GPG key and put the OTP codes under separate pass files, or maybe an entirely separate pass store. But that breaks the workflow that pass-otp was designed for.
Right now pass-otp is helping me appear more secure to the Big Five than I actually am.