ššŖš³š¬The OTP you want to use was already used
infinitevalenceNo and stop using SMS itās not secure.
andreluis034Although itās true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesnāt matter. It still is doing itās job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).
I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).
TehPersMany password managers use a biometric factor to sign in (your fingerprint, for example). This basically moves the MFA aspect to one service (your phoneās password manager) instead of having each service do their own thing. It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
Many password managers use a biometric factor to sign in
The only thing does this is replace the authentication mechanism used to unlock the vault, instead of using your master password (something you know), it uses some biometric factor (something you are), although it uses your biometric data, itās still a single factor of authentication
This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing
I am not sure I understood you here. What do you mean by āinstead of having each service do their own thingā? Each website using their own method of delivering OTPs?
It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.
I am not discrediting password managers, they have their uses, as you mention you can have unique, high entropy password on a per service basis. The only thing I am against is the password managers themselves also doubling as OTPs generators (take a look at Bitwarden Authenticator which kinda defeats the purpose of OTPs. From the perspective of OTPs it makes much more sense to use a separate application (Like Google Authenticator or Aegis Authenticator), preferably on a separate device, to generate the OTPs.
although it uses your biometric data, itās still a single factor of authentication
Speaking from my experience, I use my phone for biometric authentication. At least from my point of view, I see that as two factors (what I have and what I am) since the biometric authentication only works on my phone.
I am not sure I understood you here. What do you mean by āinstead of having each service do their own thingā? Each website using their own method of delivering OTPs?
Basically having multiple places where codes may be generated. This way you can use one location to get OTPs instead of having them delivered via SMS or generated by a different app/service. It ends up being easier and more convenient for the end user (which of course increases adoption).
I guess this has more to do with services adopting OTP generators than sending them via SMS though.
From the perspective of OTPs it makes much more sense to use a separate application (Like Google Authenticator or Aegis Authenticator), preferably on a separate device, to generate the OTPs.
If logging into the password manager to get the password is sufficiently secure (locked behind MFA), then I donāt see the benefit of using a separate OTP generator (aside from maybe if your password manager has a data breach or something, which should be a non-issue except it clearly isnāt thanks to LastPassā¦)
Iām starting to wonder if phones (or other auth-specific devices) should just become dedicated authentication devices and passwords should just be phased out entirely tbh. Passwords have always had issues because their static nature means if someone learns your password without your knowledge, that method of authentication becomes worthless. The main concern would be what happens when you lose your phone I suppose.