Hacker News new | past | comments | ask | show | jobs | submit login

If you store your 2FA recovery codes in the same place as your passwords, there is effectively no point in you having 2FA, because compromising one factor, your password manager, compromises both.



You are correct but in my use-case I have my browser remember the passwords and use a standalone password manager for storing credentials that I infrequently access. An exploit compromising the browser would next have to compromise the password manager's encrypted database.

Admittedly this is not perfect, but I am comfortable with the level of security it provides. I think it is also roughly comparable to users who have a 2FA app on their mobile and a password manager syncing to the same device.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: