8
Password managers want to also manage OTP because they're in the business of making authentication easier.
But there's a trade-off.
Managing OTP (or any other truly additional factors) in the same place as your passwords shifts the risk model. It pools multiple independent factors into a single attack surface. This turns the system(s) running the password ...
6
This is locally verified by the Lastpass extension so that you don't reuse password manager's master password itself somewhere else. Password managers use credential management API to capture credentials from the webpage.
To derive an encryption key from master password, Lastpass feeds master password into PBKDF2 with 100,100 iterations of SHA-256. One more ...
4
We, as security professionals, have been fighting for the adoption of 2FA for a long time, and now that we are reaching a wider coverage, password managers are increasingly providing support for both passwords and OTP, hence, defeating the purpose of multiple factors of authentication.
By definition, 2-factor authentication is presenting something from two ...
3
defeating the purpose of multiple factors of authentication.
No, it doesn't. OTP protects the user in case of phishing. If Joe enters its login on a cloned page, the attacker will only be able to use his credentials if he acts very fast, otherwise the OTP will have expired.
It protects the user in case of credential leak too. As most users will not have a ...
1
Using a signed token as password reset token can be secure. For example, Django uses a signed token.
One risk with this is that the password reset JWT can be used for authentication. Your password reset mechanism creates a JWT with sub=userId. Presumably, your authentication mechanism also creates a JWT with sub=userId. These must not be interchangeable. A ...
1
This system works, though it's needlessly expensive for your server. Bcrypt is designed for low-entropy inputs that are stored long-term where there's a risk that an attacker will see the digest. That doesn't apply here; the bcrypt digest is technically low-entropy but not dangerously so on the timescale in question (I assume you're looking at a very narrow ...
1
TLDR; Google Chrome Password Check-up fares worse compared to the likes of HIBP, Firefox Monitor, etc...
Note: The extension in the question which checks logins against known data breaches is now deprecated and the feature is now part of Google Chrome.
Now answering your question, "how good is "Chrome password checker "comparing to other ...
Only top voted, non community-wiki answers of a minimum length are eligible
