5 ms·

> I use 1Password but enable 2FA anywhere I can Why? What is the threat vector whereby you think 1Password would be compromised but an OTP system would still b

> I use 1Password but enable 2FA anywhere I can Why? What is the threat vector whereby you think 1Password would be compromised but an OTP system would still be secure? > If you can store your 2FA keys in 1Password, you're not really doing 2FA. I know. (That's why I said doing so is "bringing it back down to 1 factor.")

tptacek 11y ago
If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes. That can't happen to a properly designed physical token, and even though it can happen to a phone token, it's less likely to happen, because (at least in the iOS case) your phone is hardened much, much more severely than your OS X kernel.
- morgante 11y ago
  > If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes. Right, but at that point the account is effectively already compromised. Even if I have a second factor, they can just piggyback on the session I create when logging in via that second factor.
  - tptacek 11y ago
    That's only true if you routinely log into those services. If they pop your Mac, they get all your 1Password passwords. I like 1Password, and this isn't a flaw in 1Pw, it's just the limitations of relying on your computer for secret storage.
    - morgante 11y ago
      Good point, I hadn't considered the exploitation of sites I don't log into. Sadly, the sites which I would most like to secure in this way (ie. important but I don't use often) invariably are stuck with ancient authentication technology.
brwnll 11y ago
I have one. I used LastPass browser extension for Chrome which autofills my (unique) login credentials. This is incredibly convenient, but obviously opens up the possibility that if someone sits down at my unlocked computer, they can visit any site I have an account on and login as me. Having 2FA within the Google Auth app on my phone prevents this from happening, effectively turning my password into a rotating 6 digit key instead of 32 character nonsense.
MrManatee 11y ago
I also use a password manager, and enable two-factor authentication when possible. I mark my personal devices as trusted, so I only have to do two-factor authentication whenever I get a new device. I can think of a few examples of threat vectors where an attacker could get one of my passwords without being able to completely take over any of my devices. 1. There might be a browser vulnerability that allows a malicious web page to get one of my passwords - let's say it gets to read memory that was deallocated but not zeroed, or it gets to see the contents of my clipboard, or something like that. 2. The provider of the service I'm using might accidentally leak some of their passwords. In the worst case, they might not even notice it. 3. In some special circumstances I might have to check my mail on a computer that I don't own, and there might be a keylogger. I don't necessarily consider these threats to be very likely, but I get new devices so rarely, that even a minor improvement in security makes it is worth the inconvenience for me.

tptacek 11y ago

If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes. That can't happen to a properly designed physical token, and even though it can happen to a phone token, it's less likely to happen, because (at least in the iOS case) your phone is hardened much, much more severely than your OS X kernel.

morgante 11y ago
> If your Mac gets popped, attackers are going to own the kernel, and thus your keystrokes. Right, but at that point the account is effectively already compromised. Even if I have a second factor, they can just piggyback on the session I create when logging in via that second factor.
- tptacek 11y ago
  That's only true if you routinely log into those services. If they pop your Mac, they get all your 1Password passwords. I like 1Password, and this isn't a flaw in 1Pw, it's just the limitations of relying on your computer for secret storage.
  - morgante 11y ago
    Good point, I hadn't considered the exploitation of sites I don't log into. Sadly, the sites which I would most like to secure in this way (ie. important but I don't use often) invariably are stuck with ancient authentication technology.

brwnll 11y ago

I have one. I used LastPass browser extension for Chrome which autofills my (unique) login credentials. This is incredibly convenient, but obviously opens up the possibility that if someone sits down at my unlocked computer, they can visit any site I have an account on and login as me. Having 2FA within the Google Auth app on my phone prevents this from happening, effectively turning my password into a rotating 6 digit key instead of 32 character nonsense.

MrManatee 11y ago

I also use a password manager, and enable two-factor authentication when possible. I mark my personal devices as trusted, so I only have to do two-factor authentication whenever I get a new device. I can think of a few examples of threat vectors where an attacker could get one of my passwords without being able to completely take over any of my devices. 1. There might be a browser vulnerability that allows a malicious web page to get one of my passwords - let's say it gets to read memory that was deallocated but not zeroed, or it gets to see the contents of my clipboard, or something like that. 2. The provider of the service I'm using might accidentally leak some of their passwords. In the worst case, they might not even notice it. 3. In some special circumstances I might have to check my mail on a computer that I don't own, and there might be a keylogger. I don't necessarily consider these threats to be very likely, but I get new devices so rarely, that even a minor improvement in security makes it is worth the inconvenience for me.