Comment

Comment by LelouBil

My view is that totp/2FA prevents someone with only your password from logging in.

Having the totp seed inside a password manager doesn't break this goal, so I'm fine with it.

Of course it means if my password manager gets hacked, there's everything to log in inside, but I'm more concerned about services leaking password hashes that get broken, or accidentally getting phished (and giving up a password + totp combo that can only be used once) instead of my password manager being hacked.

parent LelouBil 2 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton