4 ms·

If the attacker got access to your 1Password account, then yes, you're screwed. However, if your password was stolen from a breached site (or something of the

If the attacker got access to your 1Password account, then yes, you're screwed. However, if your password was stolen from a breached site (or something of the like), your 2fa token, even from 1Password, would still be a second factor.

akerl_ 9y ago
Is the expectation that the site storing your password is storing your password insecurely but the 2fa symmetric key securely?
tptacek 9y ago
They've already owned up the site. They've got your password and all the TOTP secrets, for whatever that's worth. It's a 1Password password. The whole point is that the password only works on that one site. What's been gained here? If you're using 1Password, and you're considering having 1Password manage your TOTP secrets, just skip TOTP. Turn up the complexity on your passwords if that makes you feel better.
- markc 9y ago
  True, but there are many other ways people can lose control of their password other than the site being owned and TOTP helps in most of them, right? PW phished, shoulder surfed, socially engineered, etc.. I agree that separate devices is better, but given the choice of no 2FA and storing both secrets in 1PW, it still seems to me like you're better off with the latter. Happy to be corrected if I'm wrong on that.
  - tptacek 9y ago
    If there is a security benefit to enabling TOTP and then storing the secret in 1Password alongside your 1Password-generated password for that site, it is extremely marginal. I don't think TOTP is dumb; I think you should use it, but only let the keys touch your phone, never your computer.
    - OrwellianChild 9y ago
      Can I ask for clarification? If I'm managing passwords with 1Password on both my Android phone and my Windows desktop, how can I effectively use my TOTPs as a second factor? Is it enough to run the TOTPs through the Google Authenticator on my phone (alongside 1Password on the same device)? I'm unclear on what kind of separation is "useful" separation and looking for the "right" way to set this up.
dexterdog 9y ago
That's why I'm decoupled (to an extent). You can have access to my lastpass account, but that won't get you into any of my 2fa-protected accounts of which lastpass is one.

akerl_ 9y ago

Is the expectation that the site storing your password is storing your password insecurely but the 2fa symmetric key securely?

tptacek 9y ago

They've already owned up the site. They've got your password and all the TOTP secrets, for whatever that's worth. It's a 1Password password. The whole point is that the password only works on that one site. What's been gained here? If you're using 1Password, and you're considering having 1Password manage your TOTP secrets, just skip TOTP. Turn up the complexity on your passwords if that makes you feel better.

markc 9y ago
True, but there are many other ways people can lose control of their password other than the site being owned and TOTP helps in most of them, right? PW phished, shoulder surfed, socially engineered, etc.. I agree that separate devices is better, but given the choice of no 2FA and storing both secrets in 1PW, it still seems to me like you're better off with the latter. Happy to be corrected if I'm wrong on that.
- tptacek 9y ago
  If there is a security benefit to enabling TOTP and then storing the secret in 1Password alongside your 1Password-generated password for that site, it is extremely marginal. I don't think TOTP is dumb; I think you should use it, but only let the keys touch your phone, never your computer.
  - OrwellianChild 9y ago
    Can I ask for clarification? If I'm managing passwords with 1Password on both my Android phone and my Windows desktop, how can I effectively use my TOTPs as a second factor? Is it enough to run the TOTPs through the Google Authenticator on my phone (alongside 1Password on the same device)? I'm unclear on what kind of separation is "useful" separation and looking for the "right" way to set this up.

dexterdog 9y ago

That's why I'm decoupled (to an extent). You can have access to my lastpass account, but that won't get you into any of my 2fa-protected accounts of which lastpass is one.