5 ms·

Storing password + TOTP together does leave you vulnerable if your vault is stolen/broken into, but I've gone all-in on storing them in 1Password because that's

by e28eta 8y ago

Storing password + TOTP together does leave you vulnerable if your vault is stolen/broken into, but I've gone all-in on storing them in 1Password because that's a trade off I'm willing to make.

bmurphy1976 8y ago
Not me. I had the TOTP factors in my password manager for a while, and boy was it nice, but eventually I decided that was a risk I wasn't willing to take. I feel safer knowing that they have to beak into at least two different apps. I use Authy to manage my 2FA codes, but I rarely ever use the desktop app. I stick to my phone to keep a physical separation between my logins and my 2FA app. I also started storing my backup codes as a base64 encoded gpg password encrypted text file in my password manager. If I ever lose my 2FA codes I can still get into my accounts in a emergency while also protecting myself from a password manager hack. It's annoying, but as I said, I'm not willing to take the risk.
- movedx 8y ago
  > It's annoying, but as I said, I'm not willing to take the risk. Convenience is the enemy of security. I think you're making a good choice though. It's a minor inconvenience for increased security and peace of mind.
EduardoBautista 8y ago
I used to do this. Then I realized I stored the backup codes in 1Password anyways which are as good as using a TOTP. So instead of investing in another safe place to store the backup codes I decided just to go all in with TOTP in 1Password. If my 1Password vault is breached, I am pretty much in a world of trouble as it is.
- jnbiche 8y ago
  Just don't store your email password in your vault. You could probably quickly regain control of most online services if you retain control of the email you used to sign up.
  - movedx 8y ago
    Exactly right! I keep my PayPal and primary, recovery email password outside of the vault. I can recover accounts and keep money safe(r) that way. I have to remember three passwords (oh no!) and feel safer for it. It could all be in my head, though.
movedx 8y ago
It's a tough call to make, isn't it? I just figured if they get into 1Password, I'm probably dealing with someone highly sophisticated and didn't stand a chance to begin with. I don't know yet. I might stick keeping them on some physical device.
foobarbazetc 8y ago
There’s zero authentication on the Google Authenticator app and it loses all it’s data every phone upgrade. That’s basically what everyone uses. If someone gets into your 1Password it’s all over anyway. That said, I pay for the standalone app and store my vault myself. I have no actual reason not to trust AgileBits hosting it, but they must be a huge target and I’m not taking my chances.
- movedx 8y ago
  Any tips or tricks to hosting your own vault(s)? Is it simple enough?

by e28eta 8y ago

Storing password + TOTP together does leave you vulnerable if your vault is stolen/broken into, but I've gone all-in on storing them in 1Password because that's a trade off I'm willing to make.

bmurphy1976 8y ago

Not me. I had the TOTP factors in my password manager for a while, and boy was it nice, but eventually I decided that was a risk I wasn't willing to take. I feel safer knowing that they have to beak into at least two different apps. I use Authy to manage my 2FA codes, but I rarely ever use the desktop app. I stick to my phone to keep a physical separation between my logins and my 2FA app. I also started storing my backup codes as a base64 encoded gpg password encrypted text file in my password manager. If I ever lose my 2FA codes I can still get into my accounts in a emergency while also protecting myself from a password manager hack. It's annoying, but as I said, I'm not willing to take the risk.

movedx 8y ago
> It's annoying, but as I said, I'm not willing to take the risk. Convenience is the enemy of security. I think you're making a good choice though. It's a minor inconvenience for increased security and peace of mind.

EduardoBautista 8y ago

I used to do this. Then I realized I stored the backup codes in 1Password anyways which are as good as using a TOTP. So instead of investing in another safe place to store the backup codes I decided just to go all in with TOTP in 1Password. If my 1Password vault is breached, I am pretty much in a world of trouble as it is.

jnbiche 8y ago
Just don't store your email password in your vault. You could probably quickly regain control of most online services if you retain control of the email you used to sign up.
- movedx 8y ago
  Exactly right! I keep my PayPal and primary, recovery email password outside of the vault. I can recover accounts and keep money safe(r) that way. I have to remember three passwords (oh no!) and feel safer for it. It could all be in my head, though.

movedx 8y ago

It's a tough call to make, isn't it? I just figured if they get into 1Password, I'm probably dealing with someone highly sophisticated and didn't stand a chance to begin with. I don't know yet. I might stick keeping them on some physical device.

foobarbazetc 8y ago

There’s zero authentication on the Google Authenticator app and it loses all it’s data every phone upgrade. That’s basically what everyone uses. If someone gets into your 1Password it’s all over anyway. That said, I pay for the standalone app and store my vault myself. I have no actual reason not to trust AgileBits hosting it, but they must be a huge target and I’m not taking my chances.

movedx 8y ago
Any tips or tricks to hosting your own vault(s)? Is it simple enough?