4 ms·

I use it in this way too, but I had been wondering about that as well. Taking a stab at reasoning through this: My understanding is that having a second devic

by hosh 6y ago

I use it in this way too, but I had been wondering about that as well. Taking a stab at reasoning through this: My understanding is that having a second device means that if the password was stolen, someone still needs another secret to log in successfully. In this case, if a password was stolen from the site itself, the 2fa code generator is not. However, if the 1pass master key was stolen, then both the password and any 2fa code gets stolen as well. That puts the main vulnerability on the master key one uses for 1pass. (So looking at it that way, one should never use the master key as a password for anything else). It does lose the advantage of having a second authentication device, though maybe not necessarily losing the protection of a second factor. Is there something I overlooked in this? I’m no security engineer so I am not used to thinking in this way, other than maybe when I play Go.

tialaramex 6y ago
> My understanding is that having a second device means that if the password was stolen, someone still needs another secret to log in successfully. Stolen from where ? The vast majority of attacks which impact real people on today's web involve the data being stolen from servers in bulk. You should assume bad guys will steal all the available credentials. Is it possible they're too dumb to also dump the table labelled "TOTP Seeds" when they get the "Hashed passwords" table from your favourite web site? Yes, but you can't rely on attackers being incredibly dumb even though many of them are. A password manager makes TOTP moot for these scenarios as I outlined in a separate message in this thread. TOTP doesn't hurt, but if you have to pick between spending ten minutes today adding TOTP codes to accounts in your password manager or going through changing the password from "Liverpool2005" to an actual randomly generated password on a few sites you imported but didn't give fresh passwords, the latter will make much more practical difference.

by hosh 6y ago

tialaramex 6y ago

> My understanding is that having a second device means that if the password was stolen, someone still needs another secret to log in successfully. Stolen from where ? The vast majority of attacks which impact real people on today's web involve the data being stolen from servers in bulk. You should assume bad guys will steal all the available credentials. Is it possible they're too dumb to also dump the table labelled "TOTP Seeds" when they get the "Hashed passwords" table from your favourite web site? Yes, but you can't rely on attackers being incredibly dumb even though many of them are. A password manager makes TOTP moot for these scenarios as I outlined in a separate message in this thread. TOTP doesn't hurt, but if you have to pick between spending ten minutes today adding TOTP codes to accounts in your password manager or going through changing the password from "Liverpool2005" to an actual randomly generated password on a few sites you imported but didn't give fresh passwords, the latter will make much more practical difference.