pulsewidth comments on Proton releases a new app for two-factor authentication

Technology

89,627 readers

13,793 active

3,105 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

moderators

[–] pulsewidth@lemmy.world 3 points 1 year ago (2 children)

Feels like everyone has forgotten when LastPass was breached, and that was barely three years ago.

Any affected LastPass users storing their 2FA backup codes in with the rest of their login data got a rude awakening.

Anyone who had them separate was at least able to rescue those accounts. But hey do what you like people, I know convenience usually trumps security.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] artyom@piefed.social 1 point 1 year ago (1 child)

As far as I know, passwords and TOTP keys were never leaked by LastPass. Regardless, I did say almost always.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] pulsewidth@lemmy.world 0 points 1 year ago* (last edited 1 year ago)

That's just scratching the surface. Peoples credentials are increasingly captured by information stealer malware, including attacks on Keepass. So that 'almost always' ain't right regardless.

The goal of 2FA is to be 'something you have' like an authenticator device or auth app on your phone, working as a secondary verifier that you are who you say you are to the 'something you know' being your password. So if you store 2FA codes with your password then you just have two sets of 'something you know' which is far less secure - and leaves you more vulnerable.

Of course, it doesn't matter much with stuff like a low value forum account that has 2FA, but I certainly wouldn't put any of my banking or key account 2FA backup codes or credentials in a password manager or central account/password storage service. It defeats the purpose.

permalink

fedilink

source

parent