do password managers count as a MFA authentication factor

Question

When users store complicated and unremembered passwords in password manager service such as lastpass, what authentication factor does the lastpass access represent? Does forcing the need for a password manager make the secret no longer a knowledge factor but only a value to the URL key stored in an external system?

Combined with the hardware token, do we have 1.5FA rather than 2FA or is it only 1.05FA? Once the password is leaked/stored the factor appears unknown, or does it still count as knowledge?

The purpose of this question is to evaluate a 2FA policy of 'knowledge' and 'possession' that is allegedly juxtaposed with a complex password policy.

FYI here is a google doc of the full password policy I want to pitch.

Answer 1

This is where the concept of placing authentication factors in specific categories (what you know, what you have, what you are) becomes complicated. While these categories tend to be thought of as independent, they do overlap in certain areas.

Passwords are traditionally 'what you know' and I'd guess many people would always classify them that way even in this scenario where the user doesn't actually know them. Other people would say the treatment of the password in this situation has converted it from a 'what you know' to a 'what you have' factor. Some might even claim it fits into both categories simultaneously.

From the authenticating system's perspective it can't really tell whether you've memorized a password or not. It probably makes sense from a threat assessment perspective for the system owners to assume the authentication factor is being used in a traditional way, even if it might not be. But from the user's perspective they should probably assess the risk associated with how they actually manage their passwords.

All this to say that I don't think there is clear consensus on the answer to your question, but the majority would probably still classify the passwords as a 'what you know' factor. And I don't think most people would consider the use of a stored password as multi-factor authentication (MFA) without adding another factor besides the password.

UPDATE: With regards to the new concern you edited into your question, I don't believe that a complex password policy requirement necessitates that users will use a password manager. Most people do not use password managers (only 12% use them sometimes) despite any password complexity requirements on the Internet sites they frequent. There may be some correlation between users recording a password and extreme complexity/length requirements, but I'm not aware of a study showing this.

It looks like you're trying to make a case that relaxing a current password complexity policy will decrease the use of personal password storage. Your alternative appears to be an XKCD passphrase style system that primarily cares about meeting a minimum length of 16 characters. And while I agree that these passphrases can offer better security without unduly affecting usability, I'm not sure you'll make much of an impact on password storage. A study that compared use of passwords and XCKD style passphrases found that both sets of participants stored (e.g. wrote it down, had their browser save it, saved in password manager, etc) passwords and passphrases a pretty similar percent of the time. Both sets of users worry about forgetting their secrets, and take steps to prevent this. Even if a new policy allows passwords or passphrases that appear easier to remember than a previous policy it may not immediately change user behavior.

But back to your concern, while people may not agree on whether writing a password down changes its factor category, I haven't heard any serious discussion that this practice means a system relying on it as a knowledge factor loses MFA/2FA status when this happens. I believe most people would still consider it 2FA.

If you want to write up a justification on relaxing your password complexity requirements and advocating XKCD style passphrases I think there are better arguments for this change that don't count on eliminating password managers as a benefit.

Answer 2

You could say that the password manager has MFA, because you have to have the database and know the master password.

However, the attacker can still gain access to the application by obtaining your application password. Actual MFA would prevent him from accessing your account, because he doesn't have access to your phone or keyfob. This is missing with a password manager.

So it depends on the attack scenario. An offline password manager such as KeePassX has two-factor authentication in the sense that you need both the database and the password. But this does not change anything about the applications where you use those passwords.

Answer 3

So you have to look at Multi-Factor Authentication in regards to the service you are specifically authenticating against.

As an example, you are trying to login to your HR website to look at your pay stub. This access is authenticated by providing your non-private username and a private password in this example. The fact that you store your private password in a secure location like a KeePass store or LastPass vault, does not make using that private password a multi-factor authentication.

Multi-factor authentication is only used in direct regards to the service you're authenticating against, the HR website doesn't know anything about the password used other than it's something only you should know. Now if the HR website asked for that password and then asked for a private key file that you generated previously, that would be both something you know (your password, protected in a password manager) and something you have (the file), because you are proving your identity to the service with those 2 factors.

Now you can protect those factors with other factors, such as a password to decrypt your encrypted passwords or a fingerprint reader on your phone where you receive a second factor code, but that doesn't authenticate you in more than 1 way to the service you're trying to access.

Answer 4

When talking about multi-factor authentication, it's helpful to remember the purpose. The purpose is to make it more difficult for someone to steal your authentication credentials.

If someone has installed a keylogger on your computer, then they probably have access to your passwords, whether you directly typed them or not (some password managers have defenses against this). They can't, however, reach out of the computer into your pocket and borrow your Yubikey. Hence, two factors.

Similarly, if someone mugs you and steals your key, they don't have access to your password manager's stored passwords (unless they took your phone and it has the decrypted store unlocked). Two factors.

It's not really so much a matter of "Does this count as something I know?" so much as "Is this something that could be stolen in the same way as something I know?". Most ways you look at it, the answer is yes, which means you should consider them only one factor.

Answer 5

Whether it is stored in a password vault or not a password is just something you know. You could write it on a paper, give it to someone else and that is enough for him to use it, while you can still use it at the same time. Simply as it is a long and complex password, it is expected to be more strong than the mere 123 string!

On the opposite, a smartphone receiving a unique key via SMS is something you have. If I give someone else the phone for him to receive the SMS, I can no longer use it.

So here as the password can be used without the vault, there is no MFA.