3 ms·
I store my TOTP in 1Password... I think it's still more secure than SMS (because to restore 1Password vault you also need a Secret, not only your password) and
by flixic 7y ago
I store my TOTP in 1Password... I think it's still more secure than SMS (because to restore 1Password vault you also need a Secret, not only your password) and so much more convenient than a separate app, because 1Password auto-copies the TOTP code to your clipboard after filling form fields, making signing in a very smooth experience.
It is a security tradeoff that I take for most of my accounts. For a few that a much more sensitive I use a Yubikey.
- Klathmon 7y agoAnd that's fine IMO as long as you know you are making a tradeoff. But unless you have your 1Password setup to need the secret every time you go to have it fill in the password, the seed string is in memory unencrypted along with your passwords (or more specifically, it's stored in a way that it can be decrypted by the app/extension on it's own). That makes it one spectre/meltdown style exploit away from getting everything needed to login to the account. Still, if that system works for you, then good! having any 2fa (even SMS) is better than nothing, storing TOTP codes in a password manager is better than SMS, storing them in a seperate device is better still, and U2F keys are even better still. Like anything it's a gradient of tradeoffs, but I've seen too many people go from Google Authenticator to 1Password in an attempt to further secure their account, and I just like to point out that there's a good chance it's doing the opposite.