Nowadays, many Password managers offer options for 2-Factor Authentication such as TOTP. I am really confused regarding this. Isn't the whole point of 2FA is to prove you have a second way of proving your identity?

What kind of security risks would I have if I have both my passwords and 2FA within the same app compared to having them in different separate apps? Does having them within a single app pose any significant risk?


What kind of security risks would I have if I have both my passwords and 2FA within the same app?

What is your threat scenario?

It's convenient. On my laptop, both are available without any external devices. If I log on a website on a computer I don't own, I look up the password and OTP on my phone. The attacker in this scenario will get password, but not secret for 2FA - thus it thwarts many attacks in case of key loggers.

It also thwarts password leaks. If my password is leaked from another site, due to password re-use, 2FA will thwart attackers.

It obviously provides less security than a physical token, as malware on my computer may access the secret - something which is impossible with for instance a Yubikey.

Like so many other security features it's a trade-off between usability and security. It's better security, especially in some scenarios, than no 2FA, and it's weaker than a proper hardware token. It's more convenient than a hardware token, but less secure. It's cheaper than a hardware token, but also less secure...

I use both. For some sites, that would be inconvenient but not fatal to loose access to I use Bitwarden. For others, I carry a Yubikey. So in short - carry out a threat assessment. Who are you protecting against, and what attacks can they mount against you? There's no universal answer; it's a trade-off you have to make for your use case.

  • Hopefully there wouldn't be any password reuse if it's a password manager.
    – user
    Mar 15 '21 at 15:09
  • Sure, but it's a type of breach that it would protect against. It would also work against shoulder surfing.
    – vidarlo
    Mar 15 '21 at 15:11
  • Edited my question. I was looking for what new risks are there when using two separate apps for 2FA & password manager compared to combining them into one app i.e) using 2FA within the password manager.
    – Kolappan N
    Mar 15 '21 at 15:12
  • Broadly same. If it's one app, one compromise is enough. If it's separate app, both will have to be compromised. It's a security trade-off you have to make - convenience vs. security.
    – vidarlo
    Mar 15 '21 at 15:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.