It’s not very trivial to gain access to a 1password account: 1. Attacker needs access to the physical device of the account holder if they know the credentials

It’s not very trivial to gain access to a 1password account: 1. Attacker needs access to the physical device of the account holder if they know the credentials. 2. Otherwise, they need to know credentials + secret key on a new device. 3. You can set up Google Auth to access the account in the first place, which can have its own separate 2fa (this is what we do)