4 ms·

I never used to use 2FA because it was annoying to have a single point of failure that locked me out of all my accounts. Ever since I realized that the 1Passwo

I never used to use 2FA because it was annoying to have a single point of failure that locked me out of all my accounts. Ever since I realized that the 1Password desktop/mobile app can save and sync your 2FA code generators onto all of your devices, as well as automatically fill them, I have been a happy 1Password user with possibly hundreds of active 2FA setups. Even if I lose all of my devices, there is at least a clear way forward with my 1Password recovery kit. I don't need to save millions of emergency recovery codes. Still, the biggest point of convenience for me is being able to access the same 2FA codes from my laptop, phone or tablet despite only entering them once on desktop. I feel like I'm advertising for 1Password right now, but honestly this is perhaps the most exciting thing that has happened in over a decade for my personal cyber security situation. I have been able to completely decouple my phone number from my 2FA in most instances.

ford_o 5y ago
Bitwarden can do it too.
h4waii 5y ago
So just to clarify, this kinda isn't 2FA if the password and the seed are stored in the same place. I get that if your password manager is compromised, you've got bigger problems, but some account seeds for H/TOTP should stay out of it and on a paper or dedicated piece of hardware.
- aetherspawn 5y ago
  Well the seed is protected by the PK (the 1P salt certificate) and the master vault password, so even if the account password is leaked or realistically keylogged, you still get nearly all of the protection from 2FA in that case since only your devices have the 1P salt required to decrypt the 2FA seed. I don’t think that the ‘common password’ attack that 2FA would typically protect from even applies if you are using a password manager where each account is a random password. In this case you’re only protecting yourself from keyloggers or such. My 2c.

ford_o 5y ago

Bitwarden can do it too.

h4waii 5y ago

So just to clarify, this kinda isn't 2FA if the password and the seed are stored in the same place. I get that if your password manager is compromised, you've got bigger problems, but some account seeds for H/TOTP should stay out of it and on a paper or dedicated piece of hardware.

aetherspawn 5y ago
Well the seed is protected by the PK (the 1P salt certificate) and the master vault password, so even if the account password is leaked or realistically keylogged, you still get nearly all of the protection from 2FA in that case since only your devices have the 1P salt required to decrypt the 2FA seed. I don’t think that the ‘common password’ attack that 2FA would typically protect from even applies if you are using a password manager where each account is a random password. In this case you’re only protecting yourself from keyloggers or such. My 2c.