4 ms·
A single use password extension. The important thing here is that you only enter the secret once. It’s different from a password which is reused by design.
by kogir 7y ago
A single use password extension.
The important thing here is that you only enter the secret once. It’s different from a password which is reused by design.
- tptacek 7y agoRight, I know that's the obvious response, but what's it really buying you? The rationale I always see is "the server could log the request and my password would wind up in plaintext". But the problem with plaintext password logs is that in a breach, a substantial number of those passwords will be used to credential-stuff other accounts. A breach already requires you to reset all your credentials for that service, and if you're using 1Password, those credentials had no other value anyways.
- kogir 7y agoYou know, that’s actually right. I’m going to reconsider why I’m using 2FA and go all U2F or remove it entirely.
- tptacek 7y agoYou sound surprised I’m right! :)
- kogir 7y agoHa, I'd just not thought it through for some reason.
- austhrow743 7y ago2FA is strongly pushed in a lot of places. Creates an impression of importance. You just saved me a ton of hassle next time I swap phones. Cheers.
- idlewords 7y agoYou're assuming that using 1password implies you're not re-using passwords, or using easily guessable ones. Is this assumption safe to make?
- frereubu 7y agoNot entirely. But 1Password does clearly flag weak passwords and reused passwords (i.e. used for two or more items in 1Password) with a message that's not dismissible.
- tptacek 7y agoIn general, no, but for 1Password users sophisticated enough to store TOTP creds in it, I'm guessing: almost always yes.
- timoth 7y agoI feel like I must be missing something here, especially given who I'm replying to, but doesn't it mean that, even if your password is compromised, it can't be used to log into the service which is also protected by TOTP? Regardless of impact on other services if someone reuses their password. So in theory, there's no desperate need for you to reset your password for the service (though of course you should) because it's still protected by your TOTP setup. (Well, unless your current TOTP was leaked and someone reuses your password and current TOTP before it times out, if the service allows that.) Of course, it depends on the nature of the breach. I've assumed the password leak via request logging as you mentioned (and possible leak of single TOTP), but if the seed for the TOTP is also leaked (e.g. DB breach), then naturally you're in trouble!
- ensignavenger 7y agoAnd you reset the password after you find out about the leak- but that may be a long time or even forever after the leak occurs, so with only a password, you more vulnerable.
- seaurchin 7y agoI'd love a dumbed-down answer to this. Here's where I think 1Password's TOTP is useful: User creates a strong password in 1Password when signing up for a service. The password is used only for this service. The service stores all usernames and passwords in plaintext. These credentials are compromised without the service knowing. If I'm using 1Password's TOTP then, I think, an attacker is prevented from logging into the service with my credentials. If I'm not using 1Password's TOTP then the attacker can login to the service.
- cyphar 7y agoIt should be noted that the TOTP secret is probably kept in the same database (if not the same table) as the password hashes. I'm surprised we don't see more TOTP secrets in password dumps.
- tptacek 7y agoIf the service is compromised, you can't trust your TOTP secret (the little binary string from which your TOTP codes are generated) either! The protections TOTP provide in this scenario are all based on magical thinking; that it "feels" secure. But really, with respect to a specific service, if they're compromised, your credentials are worthless and need to be reset wholesale.
- pastage 7y agoSimilar, when you are using a tool to generate something unique for logon why does it have to be long? 4 characters should be plenty if you do not reuse it.