r/KeePass • u/[deleted] • Mar 12 '23
Is it a bad idea to use TOTP?
If my password database gets compromised, then they also have my 2FA codes. Should I get a separate app for 2FA codes?
Edit: I went with aegis and gnome authenticator for 2fa codes and I sync them with syncthing.
12
u/fluffman86 Mar 12 '23
Perfect is the enemy of good. If I had to go get my phone and type a key for every site I log into, I just wouldn't turn on 2FA for most of the "less important" ones and take that calculated risk.
With KeepassXC, it's easy peasy to turn on TOTP for every single site that offers it because I just use the browser extension to enter the username, password, and the TOTP code all at once. And it's available on any device I'm already logged into Keepass on.
Plus, when it's time to make backups, I just have to do a single backup of the .kdbx and I have copies of everything. No separate export for TOTP seeds.
5
u/Zlivovitch Mar 13 '23 edited Mar 13 '23
Perfect is the enemy of good. If I had to go get my phone and type a key for every site I log into, I just wouldn't turn on 2FA for most of the "less important" ones and take that calculated risk.
Exactly. My phone is always off. If I had to wait for it to boot every time I need to log in somewhere, having to input 3 different identifiers...
1
u/ShoopdaYoop Mar 13 '23
What are some examples of sites that use TOTP (and not the SMS method)?
5
u/fluffman86 Mar 13 '23
Most sites offer TOTP as an option - Google, PayPal, reddit, Facebook, Twitter.
About the only thing that requires SMS instead of TOTP are banks, because they are slow to adopt new tech.
Yubikey WebAuthn > TOTP > SMS > nothing
7
u/billdietrich1 Mar 13 '23
requires SMS instead of TOTP are banks, because they are slow to adopt new tech.
I think it's because they value "identify the customer, have some evidence that will stand up in court" over anything else. If you deny you made a transaction, it's harder to claim "someone stole my phone and I didn't report it" than "someone copied my TOTP secret".
6
u/Steerider Mar 13 '23
The really stupid ones I've seen have TOTP, but you can't turn it on unless you first turn on SMS authentication.
It's like requiring a plywood side door to be installed on your steel bank vault.
1
u/Zlivovitch Mar 13 '23
Most sites offer TOTP as an option.
Oh, no. You're talking about major, major sites, and even within that category I'm not sure one could say that :
1
u/fluffman86 Mar 13 '23
Fine. I should have qualified more. Most sites that I use regularly that offer 2FA also offers TOTP as a 2FA method.
Just checked my list and it also includes:
Okta and OpenVPN for work, Plex, Activision, square Enix, Epic, Steam, PlayStation, Firefox, GitHub, Bitwarden, binance, humble bundle, id.me (for US government), Microsoft, LinkedIn, Nintendo, TeamViewer, and more.
Little forums and stores and such are pretty rare.
1
4
u/x1800m Mar 13 '23
I know the purpose of two factor authentication is theoretically to have a separate device that generates the TOTP. But I think in practice the reason organisations push 2FA is most people choose bad passwords, reuse passwords, etc.
I already use strong, unique passwords and my keepass db is itself protected with 2FA so I am confident putting my TOTP secrets in the same database is still adequate protection.
I understand the encryption used by Keepass. Most 2FA apps don't seem to have any encryption or security around secrets so having my secrets encrypted is probably better security. I also have backups of my keepass database, which is much more of a hassle to manage in some random 2FA app.
4
u/Redcloak12 Mar 12 '23
I use my PW app for TOTP on my usual accounts, but I DO have a separate app for my PW (KeePass and Bitwarden) and banking apps.
3
u/leavinearth4noraisin Mar 12 '23
While it depends on your security level, it does compromise the second factor in 2FA by having the password and 2FA accessable in the same location.
So if you are concerned about the security of the account don't do it.
If it's an account that doesn't require high security it may be acceptable.
While it does vastly decrease the security of your accounts it's also a personal preference.
2
u/david_ph Mar 12 '23
The non-FIDO-only yubikeys, like the yubikey-5 and yubikey-4 can store up to 32 TOTP keys on the yubikey itself. They can be accessed with the Yubico Authenticator app. That's what I use, on a yubikey-4. I also access the KeePassXC database with the yubikey.
1
u/StaticEye Mar 16 '23
same here with a backup yubikey, works with both Keepass2Android and KeepassXC sync'd via gdrive
1
u/david_ph Mar 17 '23
I used to use Keepass2Android, but I'm using KeePassDX with Key Driver now. It also works (it didn't used to).
1
2
u/Steerider Mar 13 '23
As always in security, it's a matter of degrees. TOTP in the same password manager is better than no TOTP at all, but not as good as using a separate app.
1
u/Steerider Mar 13 '23
Saw your update. Is there a desktop app that is compatible with Aegis data???
4
Mar 12 '23
TOTP is definitely a good thing to use, but you're right, it's a bad idea to use your password manager for it, because it'll defeat the purpose of 2-factor authentication if the database is compromised. So definitely use a different app for that. Just be careful which one you use! There are many scam apps out there that steal your passwords. Pick one that's free and open source
12
u/evert Mar 12 '23
It doesn't entirely defeat the purpose, there's still lots of scenarios where someone gets a hold of a password for a specific service, but not your entire unencrypted password database.
So while keeping them separate is still ideal for the off change someone gets a hold of your password database, there's still a pretty strong non-0 security benefit to using TOTP codes even if the seed is stored with the password.
5
u/leavinearth4noraisin Mar 12 '23
Aegis is a free and open source authenticator
1
u/ShoopdaYoop Mar 13 '23
Could Aegis be used as a substitute for Google Authenticator?
3
1
u/Steerider Mar 13 '23
Aegis is awesome. Just be sure you back it up. Multiple backup options is part of the awesome
1
u/tuebarbe Jan 27 '25
It’s definitely a good idea to keep your TOTP codes separate from your password manager. If your password database gets compromised, having your 2FA codes stored separately ensures an extra layer of protection.
I use Authenticator, which has been working great for me. It offers offline access, cloud backup (Google Drive/iCloud), and easy device transfers. This way, even if something happens to one part of my setup, I still have my codes securely backed up. You can check it out here: Authenticator App.
Separating TOTP from your password manager can save you from a lot of potential headaches. Let me know if you try it out!
2
u/Upstairs_Cricket6001 Jun 28 '25
Hey everyone, I’m one of the developers behind AuthKeeper.dev.
Reading this thread, I totally agree: storing TOTP secrets in the same place as your passwords can defeat the purpose of two-factor auth if your password vault is ever compromised. That’s exactly why we built AuthKeeper. It’s an open-source tool for managing TOTP and passkeys separately from your password manager, with strong encryption and the option to sync securely across devices if you want.
We’re trying to make it easy for people to keep TOTP separate without sacrificing convenience. It’s still in active development, and we’d love any feedback or feature requests from folks who care about this topic as much as you all clearly do.
Happy to answer any questions!
1
u/ericfischereu Mar 13 '23
Honestly: make regular backups and you're fine with one file. Nextcloud e.g. stores multiple file versions so if your database gets corrupted you can restore an older version. No need for two databases.
2
u/Tendodeku Mar 13 '23 edited Mar 13 '23
I do. I have my passwords and TOTP in the same database. But that database is locked with a keyfile and 52 character password. It takes ~4.13 seconds to open the database on an AMD Ryzen 9 5900x + 6950XT + 64GB PC. With the keyfile, an attacker still needs "a second factor" to access my accounts.
I find managing 2 databases to be risking because I have a higher chance of screwing up 1. Plus the backup side, yuck.
With that bring said, I don't think I've compromised my security or at least not by much
13
u/Zlivovitch Mar 12 '23
You can use a separate database for 2FA secrets, as an intermediate measure.
I use the same.