KEEPING 2FA SECRETS IN A PASSWORD SAFE?
2023-01-26
The two most important things you can do to protect your online accounts
remain to (a) use a different password, ideally a randomly-generated one, for
every service, and (b) enable two-factor authentication (2FA) where it's
available.
If you're not already doing that, go do that. A password manager like
1Password, Bitwarden, or LastPass will help (although be aware that the
latter's had some security issues lately, as I've mentioned).
IMG Diagram showing a password safe on a desktop computer being used to fill the username and password parts of a login form, and a mobile phone providing the information for the second factor.
I promised back in 2018 to talk about what this kind of authentication usually
(Not all authentication looks like this, for me, because some kinds of 2FA
can't be provided by my password safe. Some service providers "push"
verification checks to an app, for example. Others use proprietary TOTP-based
second factor systems (I'm looking at you, banks!). And some, of course,
insist on proven-to-be-terrible solutions like email and SMS-based 2FA.) looks
like for me, because my approach is a little different:
IMG Diagram showing a password safe on a desktop computer being used to fill the username, password, AND second factor parts of the form.
I simply press my magic key combination, (re-)authenticate with my password
safe if necessary, and then it does the rest. Including, thanks to some light
scripting/hackery, many authentication flows that span multiple pages and even
ones that ask for randomly-selected characters from a secret word or similar
(Note: asking for a username, password, and something that's basically
another-password is not true multifactor authentication (I'm looking at you
again, banks!), but it's still potentially useful for organisations that need
to authenticate you by multiple media (e.g. online and by telephone), because
it can be used to help restrict access to secrets by staff members. Important,
but not the same thing: you should still demand 2FA.).
GIF Animated GIF showing a login form requesting a username, password, and "Google Authenticator Code". An auto-typer fills all three fields with the username "2fa-autotype-demo", a long password, and the code 676032. The "Remember Me" checkbox is left unticked.
My approach isn't without its controversies. The argument against it broadly
comes down to this:
Storing the username, password, and the means to provide an authentication
code in the same place means that you're no-longer providing a second factor.
It's no longer e.g. "something you have" and "something you know", but just
"something you have". Therefore, this is equivalent to using only a username
and password and not enabling 2FA at all.
I disagree with this argument. I provide two counter-arguments:
1. For most people, they're already simplifying down to "something you have"
by running the authenticator software on the same device, protected in the
same way, as their password safe: it's their mobile phone! If your phone can
be snatched while-unlocked, or if your password safe and authenticator are
protected by the same biometrics (Biometric security uses your body, not your
mind, and so is still usable even if you're asleep, dead, uncooperative, or if
an attacker simply removes and retains the body part that is to be scanned.
Eww.), an attacker with access to your mobile phone already has everything.
IMG Repeat of the diagram in which a PC provides all authentication, except the PC has been replaced with a phone.
2. Even if we do accept that this is fewer factors, it doesn't completely
undermine the value of time-based second factor codes (TOTP is a very popular
mechanism: you've probably used it. You get a QR code to scan into the
authenticator app on your device (or multiple devices, for redundancy), and it
comes up with a different 6-digit code every 30 seconds or so.). Time-based
codes have an important role in protecting you from authentication replay!
For instance: if you use a device for which the Internet connection is
insecure, or where there's a keylogger installed, or where somebody's
shoulder-surfing and can see what you type... the most they can get is your
username, password, and a code that will stop working in 30 seconds (Strictly,
a TOTP code is likely to work for a few minutes, on account of servers
allowing for drift between your clock and theirs. But it's still a short
window.). That's still a huge improvement on basic username/password-based
system. (It doesn't protect you if an attacker manages to aquire a dump of the
usernames, inadequately-hashed passwords, and 2FA configuration from the
server itself, of course, where other forms of 2FA (e.g. certificate-based)
might, but protecting servers from bad actors is a whole separate essay.)
Note that I wouldn't use this approach if I were using a cloud-based password
safe like those I linked in the first paragraph! For me personally: storing
usernames, passwords, and 2FA authentication keys together on somebody else's
hardware feels like too much of a risk.
But my password manager of choice is KeePassXC/KeePassDX, to which I migrated
after I realised that the plugins I was using in vanilla KeePass were provided
as standard functionality in those forks. I keep the master copy of my
password database encrypted on a pendrive that attaches to my wallet, and I
use Syncthing to push secondary copies to a couple of other bits of hardware I
control, such as my phone. Cloud-based password safes have their place and
they're extremely accessible to people new to password managers or who need
organisational "sharing" features, but they're not the right tool for me.
As always: do your own risk assessment and decide what's right for you. But
from my experience I can say this: seamless, secure logins feel magical, and
don't have to require an unacceptable security trade-off.
LINKS
HTML 1Password
HTML Bitwarden
HTML LastPass
DIR My blog post: "I'd like to change my mother's maiden name."
DIR Blog post from 2018 in which I promised to talk about how my 2FA works.
HTML KeePassXC
HTML KeePassDX
HTML KeePass
HTML My blog post about how Syncthing has improved my life.