Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?

  • umami_wasabi
    link
    fedilink
    arrow-up
    47
    ·
    edit-2
    1 year ago

    That’s just an excuse to charge more. TOTP is standardized in RFC 6238 and cost nothing to generate.

    • FlumPHP@programming.dev
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      The “Product Led Growth” crowd doesn’t care about charging based on what things cost. They only care about what the buyer will tolerate. The “value metric” that pisses me off the most is per user pricing when the service doesn’t incur costs per user.

      • Amju Wolf@pawb.social
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        The “value metric” that pisses me off the most is per user pricing when the service doesn’t incur costs per user.

        Even in cases where there is a cost per user (or there is at least a correlation in cost increase with number of users) the price is usually many orders of magnitude larger than the cost increase.

  • jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    37
    ·
    1 year ago

    bitwarden does it behind a convenience fee, fair enough, its a worth while service to support. If you self host, you have no such barriers.

    • 7heo
      link
      fedilink
      arrow-up
      4
      ·
      edit-2
      1 year ago

      Naaah, in “Multiple factor Authentication”, the word “factor” is just to look cool… The original MfA meant “Multiple fields Authentication”. (I’ll see myself out)

      • darcy@sh.itjust.works
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        i dont think i know what youre talking about?.. but factor refers to one of three types: something you know (passwords), have (totp or yubikey), or are (biometrics). having 2 passwords is almost the same as having one password, since they are the same factor. thats why having totp linked to your password manager is basically like having 2 passwords. it almost defeats the point

        • 7heo
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          I made a joke, basically saying that if you use a single device, it’s “Multiple fields authentication” as opposed to “multiple factors authentication”.

    • Amju Wolf@pawb.social
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      1 year ago

      Nowadays many services just force MFA on you in some way, and stuff like SMS or email verification is shitty, insecure and inconvenient. TOTP is then the next best thing, and having it integrated with a password manager is fine as long as you are aware of the risks.

      • darcy@sh.itjust.works
        link
        fedilink
        arrow-up
        4
        ·
        1 year ago

        mfa is good tho. i think its almost good its forced on normies. sms/email 2fa is garbage however, and google authenticator is very bad for privacy. for most people (assuming you have a phone), is it really that much to have a separate password-locked 2fa totp app? they exist for both phone and desktop, and can be synced (although personally i cant see that being a good idea). totp is basically a hidden password hashed with the current time, so if the hidden password is leaked it can be replicated at any time. if your main computer gets compromised or keylogged, then accessing one 6-digit code is worthless unless used in the next 30s, unlike the totp secrets

        • Amju Wolf@pawb.social
          link
          fedilink
          English
          arrow-up
          4
          ·
          1 year ago

          I think its almost good its forced on normies

          Sure, but ideally there should be an option to opt out for most things. Sometimes you get forced into it for the dumbest stuff.

          And, like, don’t forget that everyone’s use case is different. For most people, Google account is really important. But I might use it as a burner account and not care about its security almost at all. Then MFA is only annoying.

          is it really that much to have a separate password-locked 2fa totp app

          I use PC for most of what I do (both work and leisure). There’s a major difference between having TOTP autofilled and having to find my phone, pick it up, unlock it, find the authenticator app, click/find the correct authenticator, then typing in the code.

          Again, depends on the account, but for the vast majority of my accounts it’s complete overkill.

          Doesn’t help that many providers don’t properly remember devices/logins. If I had to sign into a given account once a year I wouldn’t care much. But when it’s monthly or more (for many, many accounts), and half of them don’t even remember the device and ask for OTP every time, it truly is a pain.

          if your main computer gets compromised or keylogged, then accessing one 6-digit code is worthless unless used in the next 30s, unlike the totp secrets

          Realistically if my main computer gets compromised I’m royally fucked either way. I try to be safe in general, know what I’m doing for the most part (definitely more than your average user, though that’s probably true about literally everyone on Lemmy) and in like 20 years since I had access to a computer I never had an issue, so I’m probably doing something right (and I used to do way, way dumber stuff on much less secure systems than one has today).

          But yeah, you’re right I probably shouldn’t have OTP in my password manager at least for my primary email. I’m sure I’ll get to fix that someday…

    • nehal3m@sh.itjust.works
      link
      fedilink
      arrow-up
      3
      arrow-down
      1
      ·
      edit-2
      1 year ago

      Not sure I agree.

      Yes, your password manager is a single point of failure this way. But I would argue any non-SMS based TOTP is better than none, so if a higher percentage of people use it the easy way instead of not at all I consider that a win.

      After all, you would still not only need the password but also access to the manager which technically is more than one factor.

  • nakal@kbin.social
    link
    fedilink
    arrow-up
    34
    arrow-down
    3
    ·
    1 year ago

    TIL password managers charge for 2FA.

    1. Get a free password manager.
    2. Get a free 2FA App. Please don’t mix passwords and 2FA so you don’t reduce it to 1FA.

    For 1) I use PasswdSafe, because I can merge databases with Password Gorilla as I like.

    For 2) I use Aegis. You can download an icon theme, which is quite cool.

    • hh93@lemm.ee
      link
      fedilink
      arrow-up
      19
      ·
      1 year ago

      For the 2nd point:

      Mixing it doesn’t reduce it to 1fa - it still makes your accounts immune to Passwort leaks and common attacks

      You are only at a 1FA level if someone hacked your PW-Manager but in that instance you’re most likely fucked anyway

      Sure for the most important accounts having 2FA in another app is good so you can at least secure those if the PW-Safe leaked but I have 2FA on every single website I use(d) that offers it - even if I’m only on there once a year so using a special app is less important than just having the additional security in the first place

      • VonReposti@feddit.dk
        link
        fedilink
        arrow-up
        7
        ·
        1 year ago

        I usually call it 1,5FA since it is reduced to one factor, namely the password manager, but that password manager is protected by 2FA.

        • Chais@sh.itjust.works
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          It’s still 2FA. They’re separate secrets. But I agree that hosting your passwords on someone else’s computer is asking for trouble.

          • 7heo
            link
            fedilink
            arrow-up
            2
            ·
            edit-2
            1 year ago

            It’s still 2FA. They’re separate secrets.

            At this point, it really depends on implementation, and the exploit.

            It the exploit can get both in one go, I’d argue that it’s technically 1FA. Else, no matter how trivial it to do both steps, it’s 2FA. But then it pushes the question back to “what is a go at it”? A script? A remote file copy? Etc.

            Kinda important technicality in my view, as separating them in the password management process is the first requirement to actually have two factors.

            However, using two apps instead of two parts of the same app isn’t much of an improvement. If the device is compromised, it doesn’t matter much how many apps you split the data into. You can always use different passphrases, no biometrics, etc, but at that point, it’s so inconvenient that you’re just better off carrying two devices…

            The point I’m making here is: 2FA were originally supposed to be actually separated (other, offline device). However, for various reasons (cost, adoption, convenience, etc), apps were pushed instead. Now we have a regression where, in most cases, 2FA or MFA are often just a “single factor authentication with extra steps”. As a matter of fact, true MFA was the main criteria when I selected my bank. And the day they force an app on me is the day I change banks.

      • Amju Wolf@pawb.social
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        You are only at a 1FA level if someone hacked your PW-Manager but in that instance you’re most likely fucked anyway

        As long as you at least have actual, separate 2FA for access to your recovery email(s) you should be more or less fine.

        Unless you mean that if your password manager is compromised it probably means that your device is compromised, which also means that you’re probably also a victim to a session hijack for the recovery email(s), in which case you are truly fucked.

        You can also have a multi-level approach where for “higher value” accounts you have a separate password database so the more valuable accounts aren’t exposed as much as everything else… There are definitely options.

  • Danileonis
    link
    fedilink
    arrow-up
    26
    ·
    1 year ago

    It’s free on KeePass, use syncthing to have personal libre cloud.

  • ddnomad@infosec.pub
    link
    fedilink
    arrow-up
    29
    arrow-down
    10
    ·
    1 year ago

    Please don’t use your password manager for TOTP tokens. It is called two factor authentication for a reason.

    • beeb@lemm.ee
      link
      fedilink
      arrow-up
      35
      ·
      1 year ago

      The reason that 2fa exists is not to protect you if someone gets their hands on your device. It’s to protect you if your “static” credentials leaked from a providers’ database or you otherwise got phished. Using a password manager to handle mfa is totally reasonable.

      • 4am@lemm.ee
        link
        fedilink
        arrow-up
        10
        ·
        1 year ago

        If you are really worried about the password manager being an intrusion vector, secure your vault with a hardware key.

      • Danileonis
        link
        fedilink
        arrow-up
        3
        ·
        edit-2
        1 year ago

        Agree. That’s another reason to always suggest KeePass!

        • Acters@lemmy.world
          link
          fedilink
          arrow-up
          4
          arrow-down
          1
          ·
          1 year ago

          You can be paranoid and split the two, but most people(99%) will be perfectly fine with KeePass.

      • Amju Wolf@pawb.social
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        There are other ways your password database could leak. For example you could use a weak password, or it could leak in some way, and if you store it on a cloud service that also got compromised you’d be fucked without a compromised device.

        But yeah, all these are much less likely.

      • ddnomad@infosec.pub
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        1 year ago

        It is reasonable yet subpar under a threat model where you do not trust any single provider, which is a model I find appropriate most of the time.

    • PrincipleOfCharity@0v0.social
      link
      fedilink
      English
      arrow-up
      24
      ·
      edit-2
      1 year ago

      I feel like this needs to be pushed back on a little bit. Don’t let perfect be the enemy of the good. Having a password manager that provides good passwords and TOTP as a second factor is way better than only using a password.

      Sure, it would be nice if you had two devices. A phone password manager and a usb security key, but for many people it is inconvenient to carry a security key to plug when you need it. I’d rather that person keep a TOTP on their phone in that case rather than not use two factor due to inconvenience.

      Your concern is mostly about “what if someone steals your phone or computer” then they have both factors. However, your average person isn’t getting hacked by someone they know, and random local thieves aren’t typically sophisticated enough to do more than re-sell stolen computer equipment. The average person is getting hacked by some dude in a foreign country who dumped a password database or phished a password. That person isn’t stealing your device so the fact that both factors are in the same place doesn’t really mean anything.

      Also, most password managers are locked by biometrics these days. In that case, it isn’t really the app that is the second factor. It is your fingerprint or face. Someone may steal your device, but if they can’t get into the password manager that needs a password and biometrics then they don’t have anything.

      • umami_wasabi
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        Except Steam and banks that are stubborn and insist to use a custom implementation rather a standard one.

        • VonReposti@feddit.dk
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          The Danish ID solution actually offers the possibility to use FIDO U2F. Unfortunately the requirements were to provide the option and not how to provide it, so you have to purchase their “special” key since you can’t use your own Yubikey even though it’s the same hardware…

    • auth
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      1 year ago

      I do that mainly for accounts I don’t care about but either way it does increase security as compared to just a password in many cases… I just wish that some of these services didn’t require TOTP

  • slazer2au@lemmy.world
    link
    fedilink
    arrow-up
    7
    ·
    edit-2
    1 year ago

    Because the business model works that way.

    Draw them in with features and lock the actual security features behind an additional pay wall.

    Enterprise environments is rife with this kind of crap. Sso.tax lists some of the worse ones.

  • nIi7WJVZwktT4Ze@fost.hu
    link
    fedilink
    magyar
    arrow-up
    5
    ·
    1 year ago

    It’s completely open and it’s just another fee you can pay. Switch to KeePass if you want restriction-free password management.