3 ms·
Can you elaborate on: >enabling TOTP (sharing of code generation) on many sites we use Are you generating TOTP codes via 1Password or something? That seems li
by jimmydorry 5y ago
Can you elaborate on:
>enabling TOTP (sharing of code generation) on many sites we use
Are you generating TOTP codes via 1Password or something? That seems like a degradation of security. I did a cursorary search and didn't find mention of 1Password providing such a "service".
- nixgeek 5y agoYes. https://blog.1password.com/totp-for-1password-users/ https://blog.1password.com/totp-for-1password-users/ It isn’t a degradation of security, in my opinion, it’s an upgrade, when certain accounts are involved. For these shared accounts, such as those used by my family, and on services which don’t support account-per-person in an “organization” or “household” sense, this still provides for TOTP in a way my spouse and I can both login. Ensuring just the loss of the password isn’t enough to compromise the account is an upgrade vs. not having TOTP enabled. Where we can both have our own accounts and use U2F tokens that’s a better story, clearly, but 1Password having this functionality is great!
- jimmydorry 5y agoI don't understand how it's not a security degredation. The point of TOTP is to make access of the service dependant on something you must have phsyically (and isolated from the internet) on you. An attacker that manages to exfiltrate 1Password data has everything they need to access the service if TOTP is part of their offering. Where as all users with TOTP on their phone would have an additional layer of protection. Even by that blog post, they have to go out of their way and clarify that using this feature means you are not longer using two-factor authentication.