3 ms·

> Using an all-in-one solution like 1Password for both password management and 2FA creates a single point of failure. Take this into account when picking your 2

> Using an all-in-one solution like 1Password for both password management and 2FA creates a single point of failure. Take this into account when picking your 2FA client. I strongly disagree with that statement, though I don't necessarily advocate use of a password manager for 2FA. When 2FA is in use, you have 2 points of failure, since the failure of either will lock you out of your account. Reducing that to 1 point of failure actually increases your overall resilience. It's like a car: reducing the number of necessary parts decreases your car's overall likelihood of breaking down.

inapis 8y ago
Not really. Having your password manager store both the tokens and the password increases the odds of all your logins being compromised in one swoop. Separate them out and you’ll at least be able to hedge against some account compromises given that your 2FA solution doesn’t fall apart. For the user it doesn’t really change much. Loss of password manager or 2FA client will lock them out of their account. This is easily hedged against because a lot of providers provide easy access to reset a password and provide backup 2FA tokens or fall over to SMS/Email tokens.
- TimTheTinker 8y ago
  > increases the odds of all your logins being compromised in one swoop Yes... but if someone has access to your 1Password account, they most likely gained physical access to or otherwise pwned your computer. Sure, it's slightly easier for an attacker to do that than to get 2FA tokens off your phone, if that's where you keep them. So the increased risk of using 1Password for 2FA (given you're already using 1Password for passwords) would be roughly quantified by taking the risk of computer pwnage and subtracting the risk of phone pwnage given they already pwned your computer -- not much in my opinion, if you're reasonably security-conscious on your computer. Note that I'm ignoring the risk of 1Password's encryption being broken or insider threat at AgileBits, which in my opinion is vanishingly small at present.

inapis 8y ago

Not really. Having your password manager store both the tokens and the password increases the odds of all your logins being compromised in one swoop. Separate them out and you’ll at least be able to hedge against some account compromises given that your 2FA solution doesn’t fall apart. For the user it doesn’t really change much. Loss of password manager or 2FA client will lock them out of their account. This is easily hedged against because a lot of providers provide easy access to reset a password and provide backup 2FA tokens or fall over to SMS/Email tokens.

TimTheTinker 8y ago
> increases the odds of all your logins being compromised in one swoop Yes... but if someone has access to your 1Password account, they most likely gained physical access to or otherwise pwned your computer. Sure, it's slightly easier for an attacker to do that than to get 2FA tokens off your phone, if that's where you keep them. So the increased risk of using 1Password for 2FA (given you're already using 1Password for passwords) would be roughly quantified by taking the risk of computer pwnage and subtracting the risk of phone pwnage given they already pwned your computer -- not much in my opinion, if you're reasonably security-conscious on your computer. Note that I'm ignoring the risk of 1Password's encryption being broken or insider threat at AgileBits, which in my opinion is vanishingly small at present.