• paholg@lemm.ee
    link
    fedilink
    English
    arrow-up
    10
    arrow-down
    2
    ·
    3 months ago

    Not if you use 2 factor to access the password manager.

      • Godnroc@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        1
        ·
        3 months ago

        To set a scene, you awake in the middle of the night because your phone is making noise. Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep. The intruder now has access to your password manager!

        They attempt to log into your bank and drain your life savings, but despite having your password it sends another prompt to your phone. This time, you wake up enough to realize something is wrong. This time, you deny the prompt.

        The entire second paragraph cannot happen if your MFA is a single factor. Don’t store MFA in your password manager!

        • Hexarei@programming.dev
          link
          fedilink
          English
          arrow-up
          5
          ·
          3 months ago

          If your MFA is stored in your password manager, you’re not getting prompts to your phone about it. You’re just prompted for a otp code that you have to go out of your way to copy/paste or type in from the manager.

        • subtext@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          ·
          3 months ago

          I mean yeah it’s less secure than if they were separated. But my mom is never going to use a separate app for passwords and 2FA, so the two in one app is still better than nothing.

        • JackbyDev@programming.dev
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 months ago

          Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep.

          The idea that people would approve that is wild to me.

          • Godnroc@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            Mate, I’ve had users who were sharing an account that only some of them had MFA prompts for. They didn’t bother checking who had initiated the prompt, they just approved it because it was easier. And that was while they were fully awake and thinking…

            • JackbyDev@programming.dev
              link
              fedilink
              English
              arrow-up
              2
              ·
              3 months ago

              What’s funny to me is that doing this while you know your target is asleep probably has a higher success rate just because they’re more likely to press the wrong thing just because their eyes are groggy. I can read my phone without my glasses but when I wake up in the night that’s not the case right away.

        • Telorand@reddthat.com
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          Bruh, if my phone is sending me notifications in the middle of the night, the first thing I’m doing is uninstalling whatever app is sending me notifications.

          If people are that gullible to fall prey to an attack like this, managing OTP in two apps is probably more than they can handle anyway. Everybody has a different threat model, and it’s okay if it’s not covered by hardware passkeys and locally hashed and managed databases.