5 ms·
2fa – A two-factor authentication agent
- fullung 9y agoOn this topic, shout-out to ykman oath (if you have a YubiKey).
- joeblau 9y agoI use 1Password for 2FA, but this is pretty awesome!
- dexterdog 9y agoIf your password manager is your 2fa is that still 2fa?
- mikeflynn 9y agoIf the attacker got access to your 1Password account, then yes, you're screwed. However, if your password was stolen from a breached site (or something of the like), your 2fa token, even from 1Password, would still be a second factor.
- akerl_ 9y agoIs the expectation that the site storing your password is storing your password insecurely but the 2fa symmetric key securely?
- tptacek 9y agoThey've already owned up the site. They've got your password and all the TOTP secrets, for whatever that's worth. It's a 1Password password. The whole point is that the password only works on that one site. What's been gained here? If you're using 1Password, and you're considering having 1Password manage your TOTP secrets, just skip TOTP. Turn up the complexity on your passwords if that makes you feel better.
- markc 9y agoTrue, but there are many other ways people can lose control of their password other than the site being owned and TOTP helps in most of them, right? PW phished, shoulder surfed, socially engineered, etc.. I agree that separate devices is better, but given the choice of no 2FA and storing both secrets in 1PW, it still seems to me like you're better off with the latter. Happy to be corrected if I'm wrong on that.
- tptacek 9y agoIf there is a security benefit to enabling TOTP and then storing the secret in 1Password alongside your 1Password-generated password for that site, it is extremely marginal. I don't think TOTP is dumb; I think you should use it, but only let the keys touch your phone, never your computer.
- OrwellianChild 9y agoCan I ask for clarification? If I'm managing passwords with 1Password on both my Android phone and my Windows desktop, how can I effectively use my TOTPs as a second factor? Is it enough to run the TOTPs through the Google Authenticator on my phone (alongside 1Password on the same device)? I'm unclear on what kind of separation is "useful" separation and looking for the "right" way to set this up.
- dexterdog 9y agoThat's why I'm decoupled (to an extent). You can have access to my lastpass account, but that won't get you into any of my 2fa-protected accounts of which lastpass is one.
- tptacek 9y agoWhy do you bother? If 1Password is generating your passwords, you're getting virtually no additional security from TOTP by having 1Password manage your TOTP secrets.
- joeblau 9y agoYou actually do get additional security. A password (in my view) is disposable. I already assume that every site that I have an account for has been compromised so the passwords 1Password is managing are burner passwords. In order to get access to my account you'd need to know my 1Password master password (which is only in my head) in order to access anything that requires MFA/2FA. If someone hacks Amazon, Coinbase, Twitter, Dropbox, Google, or any other place and somehow figures out my password, they still can't log into my accounts. Now in the case that one of those services gets hacked and they get access to more than user credentials e.g. all of the data/metadata; Then you're right, having MFA/2FA is useless. - Password is for them - TOTP is for me
- regecks 9y agoGenuine question: To what extent is it a second factor if you e.g. have both your password manager and your TOTP secrets on the same device?
- tptacek 9y agoIn no sense at all is it a second factor in that case.
- miohtama 9y agoIf it is a mobile device the chances that a remote access trojan can access TOTP codes are low. iOS and Android have better security model compares to desktops. This includes device encryption, password or similar by default and sandboxing.