4 ms·

I hate the recommendation of 2FA as the solution. I find 2FA more patronizing than anything else. I use a password manager (1Password) and have a unique, secur

I hate the recommendation of 2FA as the solution. I find 2FA more patronizing than anything else. I use a password manager (1Password) and have a unique, secure password generated for every site. If someone gets access to my passwords, that means they've compromised my 1Password keychain which is game over anyways. I'm not interested in any protection mechanisms for such an unlikely scenario. So I end up storing the 2FA keys inside of 1Password as well—bringing it back down to 1 factor, but adding annoyance and hassle. Don't make assumptions about how your users secure themselves.

tptacek 11y ago
I use 1Password but enable 2FA anywhere I can. If you can store your 2FA keys in 1Password, you're not really doing 2FA. (The distinction may not matter much in practice!)
- morgante 11y ago
  > I use 1Password but enable 2FA anywhere I can Why? What is the threat vector whereby you think 1Password would be compromised but an OTP system would still be secure? > If you can store your 2FA keys in 1Password, you're not really doing 2FA. I know. (That's why I said doing so is "bringing it back down to 1 factor.")
  - tptacek 11y ago
    If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes. That can't happen to a properly designed physical token, and even though it can happen to a phone token, it's less likely to happen, because (at least in the iOS case) your phone is hardened much, much more severely than your OS X kernel.
    - morgante 11y ago
      > If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes. Right, but at that point the account is effectively already compromised. Even if I have a second factor, they can just piggyback on the session I create when logging in via that second factor.
      - tptacek 11y ago
        That's only true if you routinely log into those services. If they pop your Mac, they get all your 1Password passwords. I like 1Password, and this isn't a flaw in 1Pw, it's just the limitations of relying on your computer for secret storage.
        morgante 11y ago
        Good point, I hadn't considered the exploitation of sites I don't log into. Sadly, the sites which I would most like to secure in this way (ie. important but I don't use often) invariably are stuck with ancient authentication technology.
  - brwnll 11y ago
    I have one. I used LastPass browser extension for Chrome which autofills my (unique) login credentials. This is incredibly convenient, but obviously opens up the possibility that if someone sits down at my unlocked computer, they can visit any site I have an account on and login as me. Having 2FA within the Google Auth app on my phone prevents this from happening, effectively turning my password into a rotating 6 digit key instead of 32 character nonsense.
  - MrManatee 11y ago
    I also use a password manager, and enable two-factor authentication when possible. I mark my personal devices as trusted, so I only have to do two-factor authentication whenever I get a new device. I can think of a few examples of threat vectors where an attacker could get one of my passwords without being able to completely take over any of my devices. 1. There might be a browser vulnerability that allows a malicious web page to get one of my passwords - let's say it gets to read memory that was deallocated but not zeroed, or it gets to see the contents of my clipboard, or something like that. 2. The provider of the service I'm using might accidentally leak some of their passwords. In the worst case, they might not even notice it. 3. In some special circumstances I might have to check my mail on a computer that I don't own, and there might be a keylogger. I don't necessarily consider these threats to be very likely, but I get new devices so rarely, that even a minor improvement in security makes it is worth the inconvenience for me.
- e1ven 11y ago
  I'm curious what you prefer for your second factor. Do you store TOTP tokens in one app, and passwords in 1Pass? Do you use SMS? With Yosemite, these are often setup to sync to show up across all your devices..
  - tptacek 11y ago
    I have a physical token, and then a couple things on my phone. I'm not super comfortable with SMS authentication but use it for lower-value stuff.
epmatsw 11y ago
What 2nd factor has a static key that allows you to store it in 1password? I don't think I've seen a second factor that isn't hardware (phone, dongle, whatever) and/or a dynamically generated code.
- forty 11y ago
  For services using standard protocols, you can use software for OTP (google authenticator is the most famous example and uses TOTP/HOTP). Edit: I might have misunderstood your question. What you can easily store for TOTP/HOTP is the seed. After that you need a software to compute the dynamic codes.
  - epmatsw 11y ago
    Yeah, I didn't know 1password supported that, I've always just used Authy on my phone.
- morgante 11y ago
  > What 2nd factor has a static key that allows you to store it in 1password? A few implementations (ex. my broker) have you read your code off a physical card they mailed with about 200 codes on it. Of course I just scanned that card into 1Password. For standardized 2FA systems, 1password actually has support for generating one time passwords (like Google Authenticator). [1] [1] https://blog.agilebits.com/2015/01/26/totp-for-1password-users/ https://blog.agilebits.com/2015/01/26/totp-for-1password-use...
  - epmatsw 11y ago
    Neat, I had no idea about that feature of 1password.
drumdance 11y ago
My biggest question with this is, what if I ever have to login using a computer or tablet that is not mine? How does 1Password deal with that case?
- 001spartan 11y ago
  Most users would have a smartphone or other device with 1Password or their password manager of choice on it, so you can copy the password manually from that device. I tend not to log in on any device that isn't mine, though.
- morgante 11y ago
  1. I have my keychain on my iPhone, so I can always look up the password there. 2. 1Password lets you publish an encrypted HTML viewer which you can share via Dropbox, so I can retrieve passwords online if need be (just need to remember my Dropbox and 1Password passwords).
- deleted 11y ago
  [deleted]

tptacek 11y ago

I use 1Password but enable 2FA anywhere I can. If you can store your 2FA keys in 1Password, you're not really doing 2FA. (The distinction may not matter much in practice!)

morgante 11y ago
> I use 1Password but enable 2FA anywhere I can Why? What is the threat vector whereby you think 1Password would be compromised but an OTP system would still be secure? > If you can store your 2FA keys in 1Password, you're not really doing 2FA. I know. (That's why I said doing so is "bringing it back down to 1 factor.")
- tptacek 11y ago
  If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes. That can't happen to a properly designed physical token, and even though it can happen to a phone token, it's less likely to happen, because (at least in the iOS case) your phone is hardened much, much more severely than your OS X kernel.
  - morgante 11y ago
    > If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes. Right, but at that point the account is effectively already compromised. Even if I have a second factor, they can just piggyback on the session I create when logging in via that second factor.
    - tptacek 11y ago
      That's only true if you routinely log into those services. If they pop your Mac, they get all your 1Password passwords. I like 1Password, and this isn't a flaw in 1Pw, it's just the limitations of relying on your computer for secret storage.
      - morgante 11y ago
        Good point, I hadn't considered the exploitation of sites I don't log into. Sadly, the sites which I would most like to secure in this way (ie. important but I don't use often) invariably are stuck with ancient authentication technology.
- brwnll 11y ago
  I have one. I used LastPass browser extension for Chrome which autofills my (unique) login credentials. This is incredibly convenient, but obviously opens up the possibility that if someone sits down at my unlocked computer, they can visit any site I have an account on and login as me. Having 2FA within the Google Auth app on my phone prevents this from happening, effectively turning my password into a rotating 6 digit key instead of 32 character nonsense.
- MrManatee 11y ago
  I also use a password manager, and enable two-factor authentication when possible. I mark my personal devices as trusted, so I only have to do two-factor authentication whenever I get a new device. I can think of a few examples of threat vectors where an attacker could get one of my passwords without being able to completely take over any of my devices. 1. There might be a browser vulnerability that allows a malicious web page to get one of my passwords - let's say it gets to read memory that was deallocated but not zeroed, or it gets to see the contents of my clipboard, or something like that. 2. The provider of the service I'm using might accidentally leak some of their passwords. In the worst case, they might not even notice it. 3. In some special circumstances I might have to check my mail on a computer that I don't own, and there might be a keylogger. I don't necessarily consider these threats to be very likely, but I get new devices so rarely, that even a minor improvement in security makes it is worth the inconvenience for me.
e1ven 11y ago
I'm curious what you prefer for your second factor. Do you store TOTP tokens in one app, and passwords in 1Pass? Do you use SMS? With Yosemite, these are often setup to sync to show up across all your devices..
- tptacek 11y ago
  I have a physical token, and then a couple things on my phone. I'm not super comfortable with SMS authentication but use it for lower-value stuff.

epmatsw 11y ago

What 2nd factor has a static key that allows you to store it in 1password? I don't think I've seen a second factor that isn't hardware (phone, dongle, whatever) and/or a dynamically generated code.

forty 11y ago
For services using standard protocols, you can use software for OTP (google authenticator is the most famous example and uses TOTP/HOTP). Edit: I might have misunderstood your question. What you can easily store for TOTP/HOTP is the seed. After that you need a software to compute the dynamic codes.
- epmatsw 11y ago
  Yeah, I didn't know 1password supported that, I've always just used Authy on my phone.
morgante 11y ago
> What 2nd factor has a static key that allows you to store it in 1password? A few implementations (ex. my broker) have you read your code off a physical card they mailed with about 200 codes on it. Of course I just scanned that card into 1Password. For standardized 2FA systems, 1password actually has support for generating one time passwords (like Google Authenticator). [1] [1] https://blog.agilebits.com/2015/01/26/totp-for-1password-users/ https://blog.agilebits.com/2015/01/26/totp-for-1password-use...
- epmatsw 11y ago
  Neat, I had no idea about that feature of 1password.

drumdance 11y ago

My biggest question with this is, what if I ever have to login using a computer or tablet that is not mine? How does 1Password deal with that case?

001spartan 11y ago
Most users would have a smartphone or other device with 1Password or their password manager of choice on it, so you can copy the password manually from that device. I tend not to log in on any device that isn't mine, though.
morgante 11y ago
1. I have my keychain on my iPhone, so I can always look up the password there. 2. 1Password lets you publish an encrypted HTML viewer which you can share via Dropbox, so I can retrieve passwords online if need be (just need to remember my Dropbox and 1Password passwords).
deleted 11y ago
[deleted]