4 ms·

Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://

Keeping your password and your OTP generator in 1Password is not TWO-factor-authentication (2FA). Since you only need your master password to get both. https://blog.agilebits.com/2015/01/26/totp-for-1password-users/ https://blog.agilebits.com/2015/01/26/totp-for-1password-use... (See the "Second Factor? No." bit). In the case where you need true second factor authentication, it needs to be another factor (i.e. device). This is a good place to have a Fido U2F key. In my experience, it takes about the same amount of time to use the key vs. using the OTP token from 1password (assuming you keep your key on you).

mnutt 10y ago
With 1password you have to have both the password database (one factor) and the password to unlock it. (another) It's not traditional 2FA but it fits pretty close. (a thing you have and a thing you know)
- matt_wulfeck 10y ago
  Let's call it 1.5 factor auth.
hamandcheese 10y ago
Even so, there are other benefits, such as your TOTP key never being sent over the network (unlike your generated password).
eridius 10y ago
You also need to have the password database. Having the master password alone is not sufficient, and having the password database is not sufficient. And of course the master password never gets transmitted over the network, so it's harder to get. If your threat model is an attacker that's compromised your specific computer (as opposed to a network attacker) then yeah, having the OTP code in your password manager isn't 2FA. But if your threat model is a networked attacker, or alternatively, is the remote site being compromised and your password leaked, then having OTP in your password manager is effectively 2FA because the attacker doesn't have either your password database (a thing you have) or your master password (a thing you know), they just have your site password. So really it comes down to what your threat model is and what risk profile you're willing to accept for a given site. For me, all I really care about is TOTP and not having "real" 2FA. But of course if you're talking about something like an AWS account that controls access to your company's data, it's probably worth investing in a YubiKey or similar.
- seanp2k2 10y ago
  Or even better: google accounts with the Google Authenticator on your phone, then require a Duo push auth. ML with some hard rules for when to require a second or third factor, like "always" when it's an admin account.
- duaneb 10y ago
  If all the factors are on the same box, it's just one factor.
  - manicdee 10y ago
    The main concern for people using TOTP from a password vault is attacks against the websites they are visiting, not compromise of their password vault. So no, the two factors are not on the same box being attacked, in the threat modes of interest. For the threat of "my stuff was stolen" then both factors are in the same box, so even having a separate piece of hardware is no use (unless you can convince the thief to not take everything and please leave the authenticator dongle behind).
    - duaneb 10y ago
      > The main concern for people using TOTP from a password vault is attacks against the websites they are visiting, not compromise of their password vault. Well, if they gain access to your machine, they can't access your iphone. Or yubikey. Just don't kid yourself—you use the same password for everything, and that's your only factor.
- carlosdp 10y ago
  No, it by absolutely no means whatsoever is 2FA, no matter how you slice it. Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account. It doesn't matter how they got that password, your physical devices are irrelevant. With 2FA, the attacker would also need access to the secondary device that has the secondary authentication, whether that be a phone, RSA key, FIDO key, etc. 1Password is not "real" or "fake" 2FA, it's straight up not 2FA at all and doesn't claim to be. It's fine to not want 2FA if you don't handle high-risk data (though that's increasingly rare these days in reality), but lets not conflate the term =P

mnutt 10y ago

With 1password you have to have both the password database (one factor) and the password to unlock it. (another) It's not traditional 2FA but it fits pretty close. (a thing you have and a thing you know)

matt_wulfeck 10y ago
Let's call it 1.5 factor auth.

hamandcheese 10y ago

Even so, there are other benefits, such as your TOTP key never being sent over the network (unlike your generated password).

eridius 10y ago

You also need to have the password database. Having the master password alone is not sufficient, and having the password database is not sufficient. And of course the master password never gets transmitted over the network, so it's harder to get. If your threat model is an attacker that's compromised your specific computer (as opposed to a network attacker) then yeah, having the OTP code in your password manager isn't 2FA. But if your threat model is a networked attacker, or alternatively, is the remote site being compromised and your password leaked, then having OTP in your password manager is effectively 2FA because the attacker doesn't have either your password database (a thing you have) or your master password (a thing you know), they just have your site password. So really it comes down to what your threat model is and what risk profile you're willing to accept for a given site. For me, all I really care about is TOTP and not having "real" 2FA. But of course if you're talking about something like an AWS account that controls access to your company's data, it's probably worth investing in a YubiKey or similar.

seanp2k2 10y ago
Or even better: google accounts with the Google Authenticator on your phone, then require a Duo push auth. ML with some hard rules for when to require a second or third factor, like "always" when it's an admin account.
duaneb 10y ago
If all the factors are on the same box, it's just one factor.
- manicdee 10y ago
  The main concern for people using TOTP from a password vault is attacks against the websites they are visiting, not compromise of their password vault. So no, the two factors are not on the same box being attacked, in the threat modes of interest. For the threat of "my stuff was stolen" then both factors are in the same box, so even having a separate piece of hardware is no use (unless you can convince the thief to not take everything and please leave the authenticator dongle behind).
  - duaneb 10y ago
    > The main concern for people using TOTP from a password vault is attacks against the websites they are visiting, not compromise of their password vault. Well, if they gain access to your machine, they can't access your iphone. Or yubikey. Just don't kid yourself—you use the same password for everything, and that's your only factor.
carlosdp 10y ago
No, it by absolutely no means whatsoever is 2FA, no matter how you slice it. Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account. It doesn't matter how they got that password, your physical devices are irrelevant. With 2FA, the attacker would also need access to the secondary device that has the secondary authentication, whether that be a phone, RSA key, FIDO key, etc. 1Password is not "real" or "fake" 2FA, it's straight up not 2FA at all and doesn't claim to be. It's fine to not want 2FA if you don't handle high-risk data (though that's increasingly rare these days in reality), but lets not conflate the term =P