#Keeweb 2fa password#
#Keeweb 2fa free#

The biggest concern is the event your password manager is compromised, and if this happened-2FA may not be your largest concern (Though still a large one for sure). So, make your own assessment based on your threat model. This can also sometimes mean the 2FA program/app retains control of your keys which leads to a major headache in the event you decide to switch to a different configuration. Another less-discussed drawback is if you are cloud-syncing, your 2FA codes are technically more exposed than a fully local setup. The root purpose of 2FA is combining something you know (a password) with something you have (an app that generates codes)-hence “two factors”. The main drawback is database and end-point security, which violate some core principals of 2FA. No more or less protection than using a dedicated 2FA app. 2FA in PWM gives some protection from certain kinds of phishing attacks that don’t take 2FA into account. Amazon account credential leaks, but not the TOTP) No more or less protection than using a dedicated 2FA app. 2FA in PWM protects from real-world breaches.

#Keeweb 2fa free#

And plus, Keeweb being Free (MIT), I can definitely trust them with my data. With my setup of having everything centralized in Gdrive, losing a device would no longer mean resetting 2FA. I once lost my phone, and with it all the 2FA I had set up, and had to reset every account that used it. An other concern is obviously the use of 2FA when using my mobile devices, but that's outside the scope of this question.įinally, this would also have the advantage of never losing the 2FA.

But at the same time, passwords stealing on my setup doesn't look like an option for an attacker, and they would rather rely on database leak/hack. It kinda feels like it's defeating the purpose of 2FA by putting all eggs in the same basket. My question is: what's your opinion on centralizing the OTP in the password manager? Then, the keepass file is also secured with a very strong, unique password, and many iterations (bruteforce definitely isn't an option there). Now, for some background: my keepass file is stored on GDrive (with eeeevery security, long password, etc.). Then, surely, it will regularly display the OTP to copy-paste. Just like a mobile app, but instead of scanning the QR code, simply enter the digits. And I recently discovered its ability to do 2FA (with OTP).

I've been using Keeweb (a keepass client) for a long tine.