Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?

  • nakal
    link
    fedilink
    291 year ago

    TIL password managers charge for 2FA.

    1. Get a free password manager.
    2. Get a free 2FA App. Please don’t mix passwords and 2FA so you don’t reduce it to 1FA.

    For 1) I use PasswdSafe, because I can merge databases with Password Gorilla as I like.

    For 2) I use Aegis. You can download an icon theme, which is quite cool.

    • hh93
      link
      fedilink
      181 year ago

      For the 2nd point:

      Mixing it doesn’t reduce it to 1fa - it still makes your accounts immune to Passwort leaks and common attacks

      You are only at a 1FA level if someone hacked your PW-Manager but in that instance you’re most likely fucked anyway

      Sure for the most important accounts having 2FA in another app is good so you can at least secure those if the PW-Safe leaked but I have 2FA on every single website I use(d) that offers it - even if I’m only on there once a year so using a special app is less important than just having the additional security in the first place

      • @[email protected]
        link
        fedilink
        71 year ago

        I usually call it 1,5FA since it is reduced to one factor, namely the password manager, but that password manager is protected by 2FA.

        • @[email protected]
          link
          fedilink
          11 year ago

          It’s still 2FA. They’re separate secrets. But I agree that hosting your passwords on someone else’s computer is asking for trouble.

          • 7heo
            link
            fedilink
            2
            edit-2
            1 year ago

            It’s still 2FA. They’re separate secrets.

            At this point, it really depends on implementation, and the exploit.

            It the exploit can get both in one go, I’d argue that it’s technically 1FA. Else, no matter how trivial it to do both steps, it’s 2FA. But then it pushes the question back to “what is a go at it”? A script? A remote file copy? Etc.

            Kinda important technicality in my view, as separating them in the password management process is the first requirement to actually have two factors.

            However, using two apps instead of two parts of the same app isn’t much of an improvement. If the device is compromised, it doesn’t matter much how many apps you split the data into. You can always use different passphrases, no biometrics, etc, but at that point, it’s so inconvenient that you’re just better off carrying two devices…

            The point I’m making here is: 2FA were originally supposed to be actually separated (other, offline device). However, for various reasons (cost, adoption, convenience, etc), apps were pushed instead. Now we have a regression where, in most cases, 2FA or MFA are often just a “single factor authentication with extra steps”. As a matter of fact, true MFA was the main criteria when I selected my bank. And the day they force an app on me is the day I change banks.

      • Amju Wolf
        link
        fedilink
        English
        21 year ago

        You are only at a 1FA level if someone hacked your PW-Manager but in that instance you’re most likely fucked anyway

        As long as you at least have actual, separate 2FA for access to your recovery email(s) you should be more or less fine.

        Unless you mean that if your password manager is compromised it probably means that your device is compromised, which also means that you’re probably also a victim to a session hijack for the recovery email(s), in which case you are truly fucked.

        You can also have a multi-level approach where for “higher value” accounts you have a separate password database so the more valuable accounts aren’t exposed as much as everything else… There are definitely options.