Remix.run Logo
danielmartins 2 hours ago

I still don’t get why password managers builders think it’s a great idea to store MFA token together with the password, totally defeating the purpose of MFA in the first place.

jscd 2 minutes ago | parent | next [-]

As a second factor of authentication, a one-time passcode is supposed to be “something you have,” which is still satisfied when stored in a password manager. It no longer serves as a preventative in the event your password manager is compromised, but it’s still fine if any individual password is.

epihelix an hour ago | parent | prev | next [-]

I use this for MFA that's forced upon me, rather than MFA I request and want.

(It still protects against a password leak, though, so doesn't entirely defeat the purpose of MFA.)

mirzap an hour ago | parent | prev [-]

Not really. MFA still protects against the much more common case where the password itself is compromised, either through a breach, reuse, phishing, interception, bad storage, etc. An MFA code is short-lived and can’t simply be reused later, unlike a password.

Keeping the password and MFA secret in the same password manager reduces separation (if someone fully compromises your vault, they will gain access to both factors). But that doesn’t make MFA pointless; it just means it doesn’t protect you against that particular failure mode.

And if someone has full access to your password manager, you already have a much bigger problem.