Erik van Straten<p><span class="h-card" translate="no"><a href="https://fedifreu.de/@smartphone" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>smartphone</span></a></span> : if the device you use to login to a server is compromised, it is game over anyway - regardless where the OTP comes from.</p><p>How it works: to prevent that you have to log in again for each transaction with the website, immediately after logging in, the website sends a 1FA session cookie (or "JWT") to your browser. Your browser will include that cookie in any request or instruction sent to the server, so that the server "knows" that it's you - who has already logged in.</p><p>So such a 1FA session cookie replaces your MFA login credentials!</p><p>Note that there are hardly any websites that bind (bind server side) session cookies to the client's IP-address. As a result, if an attacker with backdoor access to your device copies (or steals) a 1FA session cookie from your compromised device, they can use that cookie (from any client IP-address) to access your account. That is, without having to log in, i.e. without having to enter your password, nor any 2FA (T)OTP code.</p><p>Furthermore, most people are not aware that a TOTP app is a STUPID password manager: shared secrets (stored on both the server and client) need to be backed up in a secure manner (which is not typical) while such apps do not detect fake AitM (Attacker in the Middle) websites: they're not phishing resistant.</p><p>Therefore:<br>1️⃣ Make sure your client device and browser never get compromised (that would mean "game over').</p><p>2️⃣ Use a password manager that only reveals the correct credentials if the website name (aka domain name) matches the one stored in the password database. On Android and iOS/iPadOS, "Autofill" helps do just that - without requiring a browser add-on. Note: do NOT manually search the password manager database if a there is "no hit" because of an unrecognized domain name, i.e.<br> mailchimp-sso dot com<br>is NOT<br> mailchimp dot com<br>(see <a href="https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">troyhunt.com/a-sneaky-phish-ju</span><span class="invisible">st-grabbed-my-mailchimp-mailing-list/</span></a>).</p><p>3️⃣ Use a strong (long, unpredictable, not re-used but memorable) master password for your password manager and prevent "forgot it" lock-out (you may want to write it down on paper somewhere and/or share it with someone you trust).</p><p>4️⃣ Make sure you back up the password manager's database after each change, preferably in multiple locations, at least one offline. Including TOTP data in the password manager database *does* increase the risk of compromising all at once, but making sure you have access to secure backups reduces the risk of account lock-out. It's always about balancing risks.</p><p>5️⃣ Slightly unrelated: use a browser that supports "https only" and enable it. Said "https only" is a misnomer: it means "warn if http is used because https is not possible".<br>NOTE: never share any confidential info with, or trust content from, a website via a non-https connection. Also note that https (including the required certificate) do NOT AT ALL warrant a trustworthy website. In fact https only guarantees a secure connection (E2EE) between your browser and the website whose "name" (domain name) is shown in your browser's address bar. Unfortunately, in case of "Men in the Middle" proxies like CloudFlare, the shown domain name may NOT point to the actual webserver (in such a case, Cloudflare knows your password as well).</p><p><span class="h-card" translate="no"><a href="https://mastodon.com.br/@rodsilva" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>rodsilva</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@eff" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>eff</span></a></span> <br> </p><p><a href="https://infosec.exchange/tags/Passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Passwords</span></a> <a href="https://infosec.exchange/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PasswordManager</span></a> <a href="https://infosec.exchange/tags/OTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OTP</span></a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TOTP</span></a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Weak2FA</span></a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WeakMFA</span></a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Phishing</span></a> <a href="https://infosec.exchange/tags/FakeWebsites" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FakeWebsites</span></a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MitM</span></a> <a href="https://infosec.exchange/tags/EvilGinx" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilGinx</span></a> <a href="https://infosec.exchange/tags/CloudflareIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CloudflareIsEvil</span></a> <a href="https://infosec.exchange/tags/BigTechIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BigTechIsEvil</span></a> <a href="https://infosec.exchange/tags/Risk" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Risk</span></a> <a href="https://infosec.exchange/tags/Risks" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Risks</span></a> <a href="https://infosec.exchange/tags/AccountLockout" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AccountLockout</span></a> <a href="https://infosec.exchange/tags/AccountTakeOver" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AccountTakeOver</span></a> <a href="https://infosec.exchange/tags/SessionCookie" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SessionCookie</span></a> <a href="https://infosec.exchange/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>JWT</span></a> <a href="https://infosec.exchange/tags/WebSession" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WebSession</span></a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Authentication</span></a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Impersonation</span></a></p>