6 ms·
1Password can store/generate TOTP codes.
by foobarbazetc 8y ago
1Password can store/generate TOTP codes.
- movedx 8y agoAnd copy them to the clipboard automatically when it detects you'll need it. I'm slowly moving my TOTPs codes over.
- e28eta 8y agoStoring password + TOTP together does leave you vulnerable if your vault is stolen/broken into, but I've gone all-in on storing them in 1Password because that's a trade off I'm willing to make.
- bmurphy1976 8y agoNot me. I had the TOTP factors in my password manager for a while, and boy was it nice, but eventually I decided that was a risk I wasn't willing to take. I feel safer knowing that they have to beak into at least two different apps. I use Authy to manage my 2FA codes, but I rarely ever use the desktop app. I stick to my phone to keep a physical separation between my logins and my 2FA app. I also started storing my backup codes as a base64 encoded gpg password encrypted text file in my password manager. If I ever lose my 2FA codes I can still get into my accounts in a emergency while also protecting myself from a password manager hack. It's annoying, but as I said, I'm not willing to take the risk.
- movedx 8y ago> It's annoying, but as I said, I'm not willing to take the risk. Convenience is the enemy of security. I think you're making a good choice though. It's a minor inconvenience for increased security and peace of mind.
- EduardoBautista 8y agoI used to do this. Then I realized I stored the backup codes in 1Password anyways which are as good as using a TOTP. So instead of investing in another safe place to store the backup codes I decided just to go all in with TOTP in 1Password. If my 1Password vault is breached, I am pretty much in a world of trouble as it is.
- jnbiche 8y agoJust don't store your email password in your vault. You could probably quickly regain control of most online services if you retain control of the email you used to sign up.
- movedx 8y agoExactly right! I keep my PayPal and primary, recovery email password outside of the vault. I can recover accounts and keep money safe(r) that way. I have to remember three passwords (oh no!) and feel safer for it. It could all be in my head, though.
- movedx 8y agoIt's a tough call to make, isn't it? I just figured if they get into 1Password, I'm probably dealing with someone highly sophisticated and didn't stand a chance to begin with. I don't know yet. I might stick keeping them on some physical device.
- foobarbazetc 8y agoThere’s zero authentication on the Google Authenticator app and it loses all it’s data every phone upgrade. That’s basically what everyone uses. If someone gets into your 1Password it’s all over anyway. That said, I pay for the standalone app and store my vault myself. I have no actual reason not to trust AgileBits hosting it, but they must be a huge target and I’m not taking my chances.
- movedx 8y agoAny tips or tricks to hosting your own vault(s)? Is it simple enough?
- foobarbazetc 8y agoThis plus the iOS 12 auto fill integration are like the greatest things ever. I used to be a Keychain + Authy user but moved everything to 1Password.