Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?
That’s just an excuse to charge more. TOTP is standardized in RFC 6238 and cost nothing to generate.
The “Product Led Growth” crowd doesn’t care about charging based on what things cost. They only care about what the buyer will tolerate. The “value metric” that pisses me off the most is per user pricing when the service doesn’t incur costs per user.
its best to keep passwords and totp separate
Not sure I agree.
Yes, your password manager is a single point of failure this way. But I would argue any non-SMS based TOTP is better than none, so if a higher percentage of people use it the easy way instead of not at all I consider that a win.
After all, you would still not only need the password but also access to the manager which technically is more than one factor.
Naaah, in “Multiple factor Authentication”, the word “factor” is just to look cool… The original MfA meant “Multiple fields Authentication”. (I’ll see myself out)
i dont think i know what youre talking about?.. but factor refers to one of three types: something you know (passwords), have (totp or yubikey), or are (biometrics). having 2 passwords is almost the same as having one password, since they are the same factor. thats why having totp linked to your password manager is basically like having 2 passwords. it almost defeats the point
I made a joke, basically saying that if you use a single device, it’s “Multiple fields authentication” as opposed to “multiple factors authentication”.
ohh yeah i get it good one
It’s free on KeePass, use syncthing to have personal libre cloud.
Please don’t use your password manager for TOTP tokens. It is called two factor authentication for a reason.
The reason that 2fa exists is not to protect you if someone gets their hands on your device. It’s to protect you if your “static” credentials leaked from a providers’ database or you otherwise got phished. Using a password manager to handle mfa is totally reasonable.
If you are really worried about the password manager being an intrusion vector, secure your vault with a hardware key.
Agree. That’s another reason to always suggest KeePass!
You can be paranoid and split the two, but most people(99%) will be perfectly fine with KeePass.
It is reasonable yet subpar under a threat model where you do not trust any single provider, which is a model I find appropriate most of the time.
I do that mainly for accounts I don’t care about but either way it does increase security as compared to just a password in many cases… I just wish that some of these services didn’t require TOTP
Keepassxc and macpass do it for free
Because the business model works that way.
Draw them in with features and lock the actual security features behind an additional pay wall.
Enterprise environments is rife with this kind of crap. Sso.tax lists some of the worse ones.
I use KeePassXC which doesn’t charge a cent for this.
deleted by creator
