2 ms·
No, it by absolutely no means whatsoever is 2FA, no matter how you slice it. Regardless of where your password database is, the attacker only needs to compromi
by carlosdp 10y ago
No, it by absolutely no means whatsoever is 2FA, no matter how you slice it.
Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account. It doesn't matter how they got that password, your physical devices are irrelevant.
With 2FA, the attacker would also need access to the secondary device that has the secondary authentication, whether that be a phone, RSA key, FIDO key, etc.
1Password is not "real" or "fake" 2FA, it's straight up not 2FA at all and doesn't claim to be. It's fine to not want 2FA if you don't handle high-risk data (though that's increasingly rare these days in reality), but lets not conflate the term =P
- eridius 10y ago> Regardless of where your password database is, the attacker only needs to compromise 1 password on the website to access your account. What are you talking about? The whole point of TOTP is if the attacker compromises your password, they still can't log in because they don't have the TOTP code.