19
Dedicated Authenticators from Password Manager vendors
(sh.itjust.works)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 02 Mar 2024
19 points (91.3% liked)
Open Source
31358 readers
534 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
- !libre_culture@lemmy.ml
- !libre_software@lemmy.ml
- !libre_hardware@lemmy.ml
- !linux@lemmy.ml
- !technology@lemmy.ml
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
No. If anyone has access to your email or master password, they can simply reset any other account. How would your difficult (one time used) password of protonmail be leaked? Proton doesn't have it. Only if you've got powerful malware on your device and then it doesn't matter in which app your shit is stored.
What? No. That depends on the site in question. If you have 2FA, the site should not let you reset your password without that 2FA - it's one of the major points of even having 2FA. If a website lets you reset your password without the multifactor auth you set up, they're doing it wrong.
Edit: to be clear, we're talking about having your multifactor auth in the same vault as you keep your passwords. That's fine to do as long as your vault doesn't get breached. If you do get breached, having your TOTP secrets in a different vault will help keep at least some of your accounts safe.
I think they are suggesting the abality to reset 2fa for a service if they have access to your email.
Let's say your database contains your email service, and bank account without 2fa. Let's also assume they got acess to your email through a sham site that had you type credentials in and 2fa.
Hacker gets database.
They can login into your email and use the recovery code the bank send to your email for "lost my 2fa". (And delete the mail notifications as they come in, hopefully before you catch on)
A bank (should) have additional steps such as phone number, or a real recovery key you were supposed to write down, but a random online store or entertainment site will probably will just reset the 2fa and the hacker can go from there.
Realsisticlly we should be using at least 3 password database files with different master passwords for better security.
However in practice, that is a pain in the ass and if someome has taken the time to breach your 1 specific database instead of going after easier targets, they probably have all your databases.