I suppose that you could have a separate database for your TOTP secrets, but I think that the autofill already helps with spotting phishing, which I believe is a good trade. If my autofill doesn’t work all of a sudden, I might check the domain name again.
Comment on Rawr
unexposedhazard@discuss.tchncs.de 4 days ago
I was always annoyed with MFA because i didnt like needing multiple devices or applications just to log into one shitty website. Now i have my TOTP stuff stored in keepassxc so it just autofills with zero hassle :)
RobotZap10000@feddit.nl 4 days ago
interdimensionalmeme@lemmy.ml 3 days ago
Isn’t that effectively back to single factor?
jj4211@lemmy.world 3 days ago
Realistically speaking, MFA most importantly is to get away from the “something you know” factor since that is generally more vulnerable. Even if it is a single factor, it’s a better factor.
Also enables people to meaningfully have multiple factors if they choose. The password managers generally require a master passphrase and/or unlocking through something like “Windows Hello”
gamermanh@lemmy.dbzer0.com 3 days ago
Every manager I’ve encountered requires unlocking before it’ll fill anything in, meaning it is MFA usually
The 3 factor types are something you are, know, and have. On my phone for example I unlock my device with a pin code and my password manager with biometrics (know & are)
It gets iffier on desktop devices for sure but if you get a cheapo fingerprint scanner you can make it guaranteed MFA ezpz, unlock the PC with your fingerprint and enter your password to get to the password manager
unexposedhazard@discuss.tchncs.de 3 days ago
Yeah basically, but MFA is honestly not that needed if you use a password manager, secure passwords and URL based autofill. MFA was invented to protect plebs that use bad passwords and easily fall for phishing sites.
stonedtemplepilot@lemmy.world 3 days ago
It’s still good practice even if your password is secure. That way people still need your MFA code if your data ever gets leaker or stolen.
unexposedhazard@discuss.tchncs.de 3 days ago
Yeah but in that sense my method still fulfills that requirement. They would need to actually get access to my locally stored kdbx file and my master key. If they get that then everything is fucked anyways.