All Questions

Filter by
Sorted by
Tagged with
1
vote
3answers
257 views

What security benefit does 2FA provide a password manager?

It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
-2
votes
3answers
190 views

Why do services that use 2-factor authentication still ask you to provide a password?

The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
8
votes
2answers
268 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
1
vote
0answers
233 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
3
votes
4answers
5k views

Hardware-Based Password Manager

Folks, I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I ...
1
vote
1answer
212 views

How to share “secure” account credential with my spouse?

Not sure if this is the right place to ask, but here goes: My spouse and I have 20-ish or so accounts (retirement, investment, banks, insurances, tax, etc.) where I would we both would like to have ...
2
votes
1answer
773 views

Password management with two factor authentication

I was taking a look at the Dashlane site and noticed that they support two factor authentication for your password 'vault'. One of my biggest concerns surrounding using a password manager was the fact ...
-1
votes
1answer
131 views

What is optimal way to connect accounts to 2FA on phone?

I have Google Acc 0 (GAO) mostly for bank porpoises and some "official" services. This email basically "surname.name@google.com" and I put in my old C.V. and some other contact information. When I got ...
4
votes
4answers
3k views

Best practices for storing 2FA recovery codes

I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options: In a secure note on LastPass In a Dropbox folder On a usb stick ...
1
vote
1answer
131 views

Password manager or two -actor authentication

For the critical services, is it safer to have different complex passwords and a password manager or the same password for every service and a two-factor authentication? The password manager is risky ...
3
votes
1answer
127 views

How can I back up my iPhone without compromising my 2FA and master keys?

I've noticed that when I restore my old iPhone's backup to a new iPhone, 1Password's master-key (which is never supposed to leave the device 1Password is installed on, and you transfer manually), my ...
1
vote
0answers
126 views

DD Authentication - How do I keep my credentials secure? [duplicate]

The future is here. The good folks over at Stack Overflow will soon release new forms of authentication, namely DDA, SSA, and BBA. Using it at home is perfectly reasonable since most of our homes are ...
6
votes
3answers
3k views

Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If ...
1
vote
2answers
1k views

Google login 2 factor authentication sms -fake or real?

All my 2 factor authentication used to come from Google sms, but recently I've had the following numbers come up on my phone. I realise that to do this the person would need to have my phone number. I ...
10
votes
1answer
8k views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
22
votes
3answers
3k views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
5
votes
1answer
235 views

Storing base passwords in Lastpass

After watching Mr Robot I finally motivated myself to setup two factor authenitication for Lastpass with Yubikey. Fastmail is the second service I've set up with my Yubikey. I changed my main ...
2
votes
1answer
471 views

Is it sensible to use application password bypassing two factor authentication? [duplicate]

I discovered that some applications (like Sylpheed) seems unable to support two factor authentication. Google has a feature called application passwords - a separate password that "grants complete ...
6
votes
2answers
938 views

Should a 2FA recovery key be stored along with a password?

Many websites give you a recovery key or a list of recovery codes that can be used in place of 2FA tokens if you lose your phone or can't access your token generator. What are the recommended ...
20
votes
4answers
19k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
6
votes
2answers
2k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
16
votes
2answers
721 views

Mitigating the loss of a mobile phone used for second-factor login

Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
3
votes
1answer
1k views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
14
votes
3answers
2k views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) SMS/Voice ...
5
votes
1answer
3k views

Which cross-platform password managers support encryption using a hardware token?

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode. Read more here: ...