It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other systems, but it could very well also be U2F-based or similar.
However, TOTP-based two-factor algorithms don't store a secret in their digits, neither does U2F provide the ability to encode a secret in its response.
Given this, this leads me to one of the following assumptions:
- The password manager server will refuse to send you your (encrypted) vault unless you present 2FA credentials,
- Or your password vault has multiple keys, one of which is stored (I'd assume visible to a theoretical rogue employee) on the server and sent down after a 2FA challenge is passed.
Assuming the above is correct, the "second factor" would only be protecting something static: either a static encryption key sent by the server, or the encrypted vault itself. In theory, a rogue employee of a cloud-based password manager would then be able to use their access to either get my vault or one part of my vault's encryption key.
Similarly, non-cloud password managers (such as KeePass) would have the same issue. The 2FA section would only be a measure implemented in code (and, assuming an attacker has enough access, something they'd be able to patch out).
So, unless I've missed something critical here, what real security benefit does 2FA provide on a password vault? How would 2FA realistically protect me against a stolen vault file more than just a strong password?