logoalt Hacker News

mirzapyesterday at 11:03 PM0 repliesview on HN

Not really. MFA still protects against the much more common case where the password itself is compromised, either through a breach, reuse, phishing, interception, bad storage, etc. An MFA code is short-lived and can’t simply be reused later, unlike a password.

Keeping the password and MFA secret in the same password manager reduces separation (if someone fully compromises your vault, they will gain access to both factors). But that doesn’t make MFA pointless; it just means it doesn’t protect you against that particular failure mode.

And if someone has full access to your password manager, you already have a much bigger problem.