Michael Tsai Blog - Is It Safe to Store Passwords and 2FA Codes Together?
Michael Tsai Blog - Is It Safe to Store Passwords and 2FA Codes Together?
You're viewing a single thread.
I feel like that defeats the purpose of 2fa.
I agree for the most part but it doesn't entirely defeat the purpose. If someone got a hold of your password for a website it would still protect you. And let's be honest, that's the most likely scenario. But yes if someone got into your password manager then it's completely game over. A scenario where having a separate 2fa device would still protect you.
It defeats the purpose in the scenario that your vault is stolen and decrypted. But it still protects you in the much more likely scenario that a data breach exposes your password somewhere else.
It definitely defeats the purpose. If you store them together there’s only one factor!
Things you know, have, or are.
It just becomes two things you know.
Password managers do have two factors: the vault (have) and the master password (know).
Those factors need to be separate to be factors.
It depends on your password manager and sync method. With most if I take all your devices away from you, you can’t go to any public computer and access all your passwords using only what you know. You need to have one of your physical devices.