6

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service.

If someone gets access to the decrypted password database (e.g. while the password manager is unlocked or by brute forcing the master password), the attacker also has access to the TOTP token which makes Two Factor Authentication pretty useless.

In my eyes, storing the Two Factor Authentication code in the password manager is everything beyond secure.

6

Assuming you mean the initialisation code for a given 2FA series, such as required when you first configure a TOTP generator for a specific service, then yes, storing it with the other login details isn't ideal.

As you say, should someone gain access to the password safe, they'd be able to log in without any hassle by using their own TOTP generator with the same initializations.

If you wanted to keep 2FA initialization values, a second password safe, kept apart from your day to day one wouldn't be a terrible idea, but you wouldn't want to keep the password in the main safe! Since you should only require the values very infrequently, they don't need to be as easily accessible. Even a print out in a safe may be acceptable.

Some services allow you to generate one use codes to regain access to your account in the event of 2FA device loss or failure. In that case, it's probably better to rely on those, rather than keeping the initialization values around, since they usually can't be used to gain access without a notification being sent.

2

I don't think it's as bad an idea as you assume. Think about what threats you're trying to guard against by using TOTP, and think about what attack scenarios are made easier (or not) if storing the TOTP seed in your password safe.

With the seed in your password database, TOTP will still guard against:

  • Password breaches of the website where you hold your account
  • Keyloggers on untrusted computers (on which I assume you will not actually run your password manager, but rather read a password off a trusted device and type it in manually)
  • Network captures on open WiFi networks, etc.
  • Phishing/social engineering of you, the user

Things which are NOT guarded against include:

  • Social engineering of customer service/tech support of the website owner
  • A stolen password database and master password

The first case cannot be helped regardless of where your TOTP seed is stored. The second case deserves some additional consideration. Specifically, how can your database and master password be breached? Either:

  • The attacker obtains a copy of your database from cloud storage, or a discarded backup, and cracks your master password. A strong master password (80+ bits of entropy) and secure implementation of a KDF on the part of the password manager developers should completely prevent this attack.
  • The attacker puts malware on your machine which is specifically designed to target your password manager. But consider: if you have such targeted malware on your machine, why not write malware to hijack a browser session? Or force-install a browser extension to steal all the desired information? Or install a custom certificate to allow a MITM attack? A browser extension could even display pages making it look like you were simply logging into the site again, whereas in reality you were providing the credentials needed to disable 2FA entirely!

Now, some caveats: there is ready-made malware (or at least proof-of-concept code) out there which can already target specific password managers. I'm not aware of any ready-made malware that interactively takes over an account to disable 2FA.

But the point is, the only scenario where the TOTP seed causes problems for you, is a scenario that would also cause problems even if your TOTP seed was stored elsewhere. With that in mind, I've not seen any convincing arguments against keeping the TOTP code in my password manager, especially for password managers that can use the TOTP seed to generate the codes for you in place of Authenticator, Authy, etc.

  • 1
    I would argue good security requires you to assume nothing is flawless. TOTP is one way to add an additional layer that requires a separate compromise. Putting your TOTP seeds in the same place as your credentials will collapse the "something you have, something you know" construct down to "something you know". You are then entirely dependent on the security of one system - the password database. This doesn't seem wise to me. – Duncan Jones May 20 '17 at 6:36
  • Well, you still need to obtain a copy of the password database as well. A simple phishing campaign or MITM will not be enough. I'm not depending on the security of only one system, I'm depending on at least two: first, I'm depending on my PC not to be compromised. Second: I'm depending on my password database being secure. Compare that to TOTP on a second device. I'm still only depending on two systems: my PC is not compromised, and my phone is not compromised. It's not removing an obstacle, it's replacing it. The phone storage of a TOTP seed is often not encrypted at all, or only weakly. – Ben May 22 '17 at 15:17
  • If the password database is compromised then you're doomed surely? You are dependent upon only one system if your TOTP seeds are stored in it. If I somehow compromised LastPass, for example, I would have peoples credentials and the means necessary to generate their TOTP tokens. They wouldn't even know I was doing it, until LastPass discovered the breach. – Duncan Jones May 22 '17 at 18:47
  • You'd also be doomed if an attacker compromised your phone. It goes from "must compromise my phone" to "must compromise one of my devices" if I store the seed in my database. And my database is encrypted better than my phone to boot. – Ben May 23 '17 at 3:34
  • If an attacker compromises my phone, they could access my TOTP tokens, but not my credentials. If I'm practicing good security, I won't use my phone to access the sites protected by the TOTP seeds. So the attacker still has to crack the password database separately. This is the very essence of 2FA. – Duncan Jones May 23 '17 at 7:44
0

Storing TOTP seed within the password manager means: Anyone who gains access to the information stored in your password manager can circumvent 2FA completely and has access to everything.

Not storing TOTP seed within password manager means: Anyone who gains access to the information stored in your password manager can not circumvent 2FA and still cannot access every account you have that is protected by 2FA.

"Complete access to everything" vs. "still no access to 2FA protected logins".

That is a big deal and I felt a need for this answer since that is what it all boils down to.

Having TOTP seeds stored separated from the rest gives you more security and has no drawbacks at all when talking about security compared to storing TOTP seeds in your password manager.

The only gain you have from merging it all in the same place is quality of life. At the price of security!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.