8 ms·
I use 1password for TOTP too, and this detaches my device from it. Now if I lose my phone, I just need to be able to access the app on my next phone and I'm all
by pvinis 7y ago
I use 1password for TOTP too, and this detaches my device from it. Now if I lose my phone, I just need to be able to access the app on my next phone and I'm all set.
I know that keeping the password and the TOTP at the same place is kinda not great, but I prefer this "risk" to the "hassle" you mentioned.
I'm open to better solutions!
- spsoto 7y ago+1 to this! Moreover, if you are invested into the Apple ecosystem, seamlessly integrates with iOS and comes with a WatchOS app, so you can see your 2FAs in the Watch. A huge convenience when doing TOTP from the phone.
- giobox 7y agoWhile you can use the watch for this, it's kind of a waste of time with the latest version of 1Password. 1Password automatically copies the TOTP to the clipboard for 1 minute after entering a password so you can paste the TOTP in immediately after 1Password has autofilled the initial login screen. Works this way on Windows, iOS and macOS too. If you are using 1Password for TOTP this is synced anyway, making using the phone watch/app on a Mac or iPhone for the TOTP redundant. Just mash ctrl+v/cmd+v!
- tptacek 7y agoAt this point, what is TOTP actually doing for you? If you're using 1Password, it's already generating unguessable passwords for you. Your TOTP codes are literally just an extension of that password.
- kogir 7y agoA single use password extension. The important thing here is that you only enter the secret once. It’s different from a password which is reused by design.
- tptacek 7y agoRight, I know that's the obvious response, but what's it really buying you? The rationale I always see is "the server could log the request and my password would wind up in plaintext". But the problem with plaintext password logs is that in a breach, a substantial number of those passwords will be used to credential-stuff other accounts. A breach already requires you to reset all your credentials for that service, and if you're using 1Password, those credentials had no other value anyways.
- kogir 7y agoYou know, that’s actually right. I’m going to reconsider why I’m using 2FA and go all U2F or remove it entirely.
- tptacek 7y agoYou sound surprised I’m right! :)
- kogir 7y agoHa, I'd just not thought it through for some reason.
- austhrow743 7y ago2FA is strongly pushed in a lot of places. Creates an impression of importance. You just saved me a ton of hassle next time I swap phones. Cheers.
- idlewords 7y agoYou're assuming that using 1password implies you're not re-using passwords, or using easily guessable ones. Is this assumption safe to make?
- frereubu 7y agoNot entirely. But 1Password does clearly flag weak passwords and reused passwords (i.e. used for two or more items in 1Password) with a message that's not dismissible.
- griffinmb 7y agoAgreed that you don't gain anything if you're using 1Password. But users may be required to set up MFA to access something like GitHub organizations, in which case having it available in 1Password is convenient.
- lixtra 7y agoIt mitigates passive attacks: If someone spies me entering the password (by keylogger or in person) they only get my password but cannot login 2 minutes later (TOTP tokens should not be reusable for some time, so even this 1 minute window gets closed). Plus, some buerocrat can tick the 2FA box.
- tptacek 7y agoRight, but you're mitigating an extremely marginal attack (a purely passive interception of a login) and enabling a somewhat more realistic attack, and for what? If you're just doing it to fake out 2FA requirements, sure, do whatever. But otherwise, just use 1Password passwords and skip the TOTP theater.
- lixtra 7y agoPassword leakage is not a marginal problem. I find saved passwords in public browsers all the time. Those with TOTP are much better protected against this as well.
- the_common_man 7y agoYeah, but you are not finding 1Password passwords in public browsers, are you?
- lixtra 7y agoSadly, I found ones from colleagues that use 1Password and even to me it happened that I clicked save for password that I didn’t want to save in that environment.
- giobox 7y ago1Password also has a web UI, so yes it is still very possible to copy a password from 1Password and accidentally save it on a public browser. Not to mention the simplest: type in password from 1Password on phone on public browser. Accidentally save password.
- 7y ago
- mbesto 7y agoReduction of chance for a successful phishing attack. Is it possible for a hacker to get both the password and the TOTP? Sure, but the timing of that is a 30-second window, in which the hacker needs to be extremely sophisticated in order to successfully compromise your account.
- tptacek 7y agoThis is not at all true, and we’ve dealt with unsophisticated but successful ATO attacks on TOTP all year. TOTP does not defend ordinary users against phishing.
- mbesto 7y ago> TOTP does not defend ordinary users against phishing I never said it ultimately defends ordinary users, just that it reduces the chances because it requires a more sophisticated attack.
- tptacek 7y agoYou said attackers need to be "extremely sophisticated" to pull it off, and I've spent a year seeing nitwits – clumsy and trivially detected nitwits – do it without much trouble. You were wrong, and wrong in a way that's important to correct so people know that it's wrong.
- mbesto 7y agoAnd I've seen the opposite, what's your point? How do you qualify "clumsy and trivially detected nitwits"? PS - Telling people they are "wrong" isn't convincing, and is downright condescending. Thanks for that.
- munchbunny 7y agoIt's true, putting the TOTP in a synced app actually removes the "something you have" aspect of the second factor. Now you've created a way to intercept the "something you have" factor without touching either the user or the authenticating service, so it's just an extension to the "something you know".
- sametmax 7y agoIt mitigates phishing and password reset attacks. It also means you can give access to some account to a friend or family over the phone one time, without giving them permanent access. Also good on non encrypted public wifi or in a company network with a proxy that sees and logs everything. The real word is very unperfect.
- goatsi 7y agoIt mitigates the simplest forms of phishing. If someone is running a proxy server[0] and passing everything along to the real website, token (or SMS) based 2fa can't do anything. [0]https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/ https://breakdev.org/evilginx-2-next-generation-of-phishing-...
- sametmax 7y agoHence "mitigates" and not "cancels"
- deleted 7y ago[deleted]
- souterrain 7y agoTOTP implemented with 1Password is not 2FA. All TOTP devices must store the symmetric key, yes. 1Password goes a step further and provides a UI to allow the user to simply copy the symmetric key out of the login record à la a password. TOTP clients that make opinionated design decisions prohibiting a user from getting at the symmetric key are correct implementations. That said, if one wants to mandate 2FA for one’s users, TOTP is not the right choice, given it allows users to do the wrong thing.
- alchemism 7y agoUse Authy. 2FA via account instead of device is hypothetically less-secure but as a practice for individual security, far better than being locked out of everything after the misfortune of losing a phone.
- pointillistic 7y agoAuthy only for Chrome, no Authy for Firefox.
- slazaro 7y agoIs that really a problem when you have a mobile app and a desktop app?
- graeme 7y agoNote that by default authy is vulnerable to sim porting. You can take over an authy account with a phone number.
- secabeen 7y agoYou could take over an authy account, but does that give you the ability to decrypt the encrypted blob with the TOTP secrets in it? Authy says no: https://support.authy.com/hc/en-us/articles/115001950787-Backups-password-Master-password-and-PIN-protection-with-Authy https://support.authy.com/hc/en-us/articles/115001950787-Bac...
- graeme 7y agoHaven’t you lost all your 2fa keys at that point though? Decryption aside, that seems incredibly inconvenient.
- secabeen 7y agoWell, maybe? If the SMS takeover attack results in the permanent loss of your phone number, then yes, you have lost everything. However, in most SMS takeover attacks, the attack only lasts some hours, where the attacker has control over your phone number and uses that to pivot into other accounts. With the Authy-style 2FA, they get your phone number, can then recover your Authy account, and get a copy of your encrypted blob, but they can't do anything with it. Any time they try to pivot to a different account, they don't have the 2FA and get blocked (ignoring account recovery attacks that bypass 2FA, that's out of scope). Eventually, you'd recover your SMS/phone account, and be able to download the blob, decrypt it, and have your keys. That's the model I'm seeing. One protection that Authy should include is not letting someone who has recently performed an account recovery perform a blob deletion. That should require a delay.
- akvadrako 7y agoThen it's not really 2FA anymore. Anyone with access to your 1Password account can login anywhere.
- scrollaway 7y agoIt's two-step with a unique key every login. It wipes out phishing, password reuse and password leaks as vectors.
- professorTuring 7y agoIt doesn't wipe phising. Phising is getting more and more complex, now phising sites ask you for your ToTP to gain control to your account in real-time. And that's one of the origins of FIDO2. - https://fidoalliance.org/fido2/ https://fidoalliance.org/fido2/
- dmoy 7y agoWhat's the second factor for 1password?
- graeme 7y agoThey added 2fa with duo security + a few other methods.
- UncleMeat 7y agoUnique passwords wipe out password leaks as a vector. Anything where you type in a code is also still phishable.
- scrollaway 7y agoPeople can still log into your account if your unique password leaks. It just prevents them logging into your other accounts. Point is, TOTP isn't useless.
- spookthesunset 7y agoIf anybody has access to your 1pass account, you are fucked no matter what. The biggest threat the vast majority of people face is getting one of their accounts taken over because they re-use credentials and some site, somewhere, got their account db compromised and now those credentials are on a list. Any account that has 2FA, even ones that use "weak" 2FA like SMS, will be immune to being broken into. These drive-by people won't be breaking into your 1pass account to recover your 2FA secret either--that is too much work. They'll just move on all the accounts that don't have 2FA enabled. (huge asterisk: what I said is only true for drive-by attacks where some bot is burning through a list of a million accounts to try. If somebody is specifically trying to attack you and your accounts... you've got bigger problems to worry about than simply having SMS-enabled 2FA or saving your 2FA keys in a password manager.)