0

Authy is a popular cross-platform TOTP application that supports syncing keys across devices. I have been a little confused by the idea of having a desktop client... This way if someone accesses my primary PC they'd find all my passwords saved in my browsers, and would have access to my TOTP keys as well...

Doesn't installing a TOTP client on your primary PC undermine the whole point of 2FA?

Improve this question
8
  • One could ask the same question of 2FA on phones, too. It doesn't undermine because it is not meant to protect the device but the password. – schroeder♦ Mar 24 '20 at 19:38
  • Ha, this is a great explanation, concise and informative. Thanks @schroeder – gen Mar 24 '20 at 22:00
  • Although, having read the linked question I'd contest the duplicate label, as the question itself has a bunch of additional constraints, and the only answer to the question is mostly addressing these implicit assumptions of the OP. @schroeder – gen Mar 24 '20 at 22:26
  • Then can you explain what you think the point of 2FA is? You state a threat scenario of a malicious actor having access to your PC. That access provides access to passwords and the TOTP keys. That's the same as the duplicate. The assumption made there are about relative ease compared to phones. But the context appears to be the same as yours. So, the potential difference I see is what you might mean by the point of 2FA. Can you expand on that? – schroeder♦ Mar 25 '20 at 9:15
  • 1
    We are here to answer questions. If you don't think you have what you need, feel free to rephrase. From my first comment, 2FA is meant to protect the password. Passwords are most often leaked from the services where you use them, not from the personal device (although that can happen, too). From a "password protection" perspective, put the TOPT app on a device that you control. From a "afraid of someone getting my password from my computer" perspective, then you should put the app on another device. Your question is similar to the other in this way. – schroeder♦ Mar 25 '20 at 10:21