Where to store OTP tokens

Comments

• InEnduringGrowStrong@sh.itjust.works ⁨11⁩ ⁨months⁩ ago

  I memorize the seed and calculate the next token in my head.

  Passwords in KeePass, totp in Aegis.
  My phone does have both, but they each have their own encryption.

  source
• capital@lemmy.world ⁨11⁩ ⁨months⁩ ago

  I throw them all in Bitwarden which is protected with a long, unique password and a yubikey.

  source

  • kniescherz@feddit.de ⁨11⁩ ⁨months⁩ ago

    Same. Maximum comfort since Bitwarden autofills and puts the token in your clipboard, you dont have to change apps or need you smartphone when you are on desktop.

    You are less secure though, but its worth it to me.

    source
• Xirup@lemmy.dbzer0.com ⁨11⁩ ⁨months⁩ ago

  In the case of Keepass, it is commonly said that it is best to have a database exclusively for your OTP.

  For example, you have your passwords in a db called “My passwords” with an exclusive encryption password, and then another db called “My OTP’s” with its own encryption password, so if someone somehow get access to one, that person still won’t have access to the other, and therefore cannot enter your account.

  source

  • SweetMylk@lemm.ee ⁨11⁩ ⁨months⁩ ago

    Then use the same password for both for the sake of convenience.

    source
• cooopsspace@infosec.pub ⁨11⁩ ⁨months⁩ ago

  Hardware keys for everything. Bitwarden for the rest.

  source
• randombullet@feddit.de ⁨11⁩ ⁨months⁩ ago

  Aegis with the password in a YubiKey.

  My password manager and I don’t know the password.

  source
• Extrasvhx9he@lemmy.today ⁨11⁩ ⁨months⁩ ago

  Honestly a big debate, so it really depends on your threat model. Lots of people even keep their totp seeds within their password manager which basically defeats 2fa imo, buts its highly, convenient. Personally I keep my totp seeds seperated in a sandboxed user profile.

  source

  • MangoPenguin@lemmy.blahaj.zone ⁨11⁩ ⁨months⁩ ago

    It only defeats 2FA from a standpoint of someone gaining access your PW manager. But for everything else like a server getting hacked and leaking your passwords for it, the 2FA will still do its job fine.

    source
  • lemann@lemmy.one ⁨11⁩ ⁨months⁩ ago

    I store my totp seeds in a separate, rarely used password manager, which then follows me on an “emergency USB” - hopefully something I won’t need to use at all

    source
• Vexz@kbin.social ⁨11⁩ ⁨months⁩ ago

  Depends on what is secure enough to you. For me that is secure enough but I know a ton of people out there who would say it's not secure enough for them. So in the end it's up to you. Think about the risks and make a decision.

  source
• badgrandpa@lemmy.world ⁨11⁩ ⁨months⁩ ago

  Yuibkey authenticator app looks good. All tokens are in the hardkey.

  source
• LWD@lemm.ee ⁨11⁩ ⁨months⁩ ago

  My feelings are mixed regarding whether you should keep them on the same device… But I would strongly advise against you keeping them on the same app.

  source
• Tibert@jlai.lu ⁨11⁩ ⁨months⁩ ago

  Well, the whole point of otp tokens/2fa, is to have a second login confirmation. Mostly on another device, like a phone.

  Now maybe if you store your 2fa way on the same device, but locked away with a strong password, it may work, and could be safe enough.

  But if it’s the same password as your device or another account, it isn’t that safe.

  source
• badgrandpa@lemmy.world ⁨11⁩ ⁨months⁩ ago

  I might keep the in Bitwarden, then secured with hardware key.

  source