Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?
Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?
Nowadays many services just force MFA on you in some way, and stuff like SMS or email verification is shitty, insecure and inconvenient. TOTP is then the next best thing, and having it integrated with a password manager is fine as long as you are aware of the risks.
mfa is good tho. i think its almost good its forced on normies. sms/email 2fa is garbage however, and google authenticator is very bad for privacy. for most people (assuming you have a phone), is it really that much to have a separate password-locked 2fa totp app? they exist for both phone and desktop, and can be synced (although personally i cant see that being a good idea). totp is basically a hidden password hashed with the current time, so if the hidden password is leaked it can be replicated at any time. if your main computer gets compromised or keylogged, then accessing one 6-digit code is worthless unless used in the next 30s, unlike the totp secrets
Sure, but ideally there should be an option to opt out for most things. Sometimes you get forced into it for the dumbest stuff.
And, like, don’t forget that everyone’s use case is different. For most people, Google account is really important. But I might use it as a burner account and not care about its security almost at all. Then MFA is only annoying.
I use PC for most of what I do (both work and leisure). There’s a major difference between having TOTP autofilled and having to find my phone, pick it up, unlock it, find the authenticator app, click/find the correct authenticator, then typing in the code.
Again, depends on the account, but for the vast majority of my accounts it’s complete overkill.
Doesn’t help that many providers don’t properly remember devices/logins. If I had to sign into a given account once a year I wouldn’t care much. But when it’s monthly or more (for many, many accounts), and half of them don’t even remember the device and ask for OTP every time, it truly is a pain.
Realistically if my main computer gets compromised I’m royally fucked either way. I try to be safe in general, know what I’m doing for the most part (definitely more than your average user, though that’s probably true about literally everyone on Lemmy) and in like 20 years since I had access to a computer I never had an issue, so I’m probably doing something right (and I used to do way, way dumber stuff on much less secure systems than one has today).
But yeah, you’re right I probably shouldn’t have OTP in my password manager at least for my primary email. I’m sure I’ll get to fix that someday…
i agree with your point about different use cases.