Spear-phishing can still be a threat vector, but its much rarer and also made more difficult. Phishing one is possible, but it would require the attacker to immediately use the code they phished, which significantly protects against broad phishing campaigns (as, automating a password phish + an MFA phish + logging in with that info within 30 seconds + navigating to the change password and remove MFA screen + phishing for a second and third MFA code to change the password and remove MFA is near-impossible).

Its easy to phish a password but phishing MFA codes is a lot harder because, primarily, they're temporal. This is literally the only reason behind why Google's 'account compromises dropped to zero after we required MFA internally' thing is a thing. The biggest vector MFA protects against isn't really brute forcing (though it helps there) its password phishing. Right if an attack gains access to your password vault, then one vector MFA can protect against (the multi-factor part) isn't valid. In such a case, even if somebody were to be forcefully required to allow a physical attacker to gain access to their password manager, there would still not be enough information there for the attacker to steal anything. One area where the notion of separation of keys makes more sense is cryptocurrency, where if you have any serious investment in it, it is advised to set up a multi-key scheme. It is just not the same concern as what is solved by OTP/MFA. The scenario that you ask about is a valid concern.

Rather, it is to prevent the scenario where an attacker either attempts to brute-force guess your password to a particular application (or figures it out in some other way) and now is blocked by the inability to get passed the 'enter the OTP code from your authenticator app' question. The only way for a potential attacker to utilize an OTP generated by your password manager would be to somehow gain control of the physical devices where the password manager is installed and authenticate themselves as you.Īs I understand, preventing such a scenario is not the purpose of MFA. The stored data is encrypted and will only decrypt upon being authenticated by whatever means you have setup (i.e. The assumption is that your password manager is only accessible on physical devices that you have authorized.

Lastpass totp