3 ms·
I use 1Password for all of my MFA codes on the web. It's extremely convenient to have them synced across all my devices, but I can't help but think that having
by tshaddox 5y ago
I use 1Password for all of my MFA codes on the web. It's extremely convenient to have them synced across all my devices, but I can't help but think that having my passwords and my MFA private keys stored in the same place almost entirely defeats the purpose of multi-factor authentication.
- easton 5y agoThere is still a little bit of a point, as it guarantees the password came out of 1Password and wasn't from somewhere else. If someone screencapped your password out of 1Password, it wouldn't of use unless they could get into your vault somehow.
- jeromegv 5y agoIf your passwords are leaked in a data leak, they still wouldn't get your 2FA. So I wouldn't say it entirely defeats the purpose of 2FA.
- deleted 5y ago[deleted]
- tialaramex 5y agoDepending on the leak, the secret that drives TOTP could also be in the same database table (or a nearby one). This means anybody with that secret can trivially run the TOTP algorithm and get the correct six digit code for any time present or future. If you care about MFA that can survive leaks, you want WebAuthn. As with phishing this known problem was considered in the design of WebAuthn and so your WebAuthn credentials aren't designed to need to be secret. In fact here you go, here are WebAuthn credentials for a vanity system I own, copied out of its authentication database: ID: AXnUJ920FfJlRjZtocN+9Bc9IP6gvsBiWA3GfJxckh3nQ/KekQ6xB2byfI2GM7IcGS2MpzxZs6IHmAxvgAcE/Mw= Public key: pQECAyYgASFYIFf0iDSfNpYNA5Br9zXSIUH69BqyvFcgbqy6tWC8rsLwIlggCDqury9UOzI1DnOFyE3aYwaBLvP0NyNez98v0TcieKs= That's all the backend needs to check I'm really me, and yet it's also completely useless to an attacker, they can't even use it to compare across sites and "unmask" me.
- bdamm 5y agoWebAuthn is great. Put it to work recently in a new control system and it sure is a nice feeling to deploy with zero need for passwords.
- brokenmachine 5y agoI had a quick look on wikipedia about how webauthn works, looks like you use a hardware (USB?) device to sign something with the PIN you enter. What happens if you lose that device, or if it fails?
- tshaddox 5y agoIf they stored my password in plain text, I'm not sure I would trust their 2FA implementation to actually function as a second factor to protect my account. :) Seriously though, isn't this a little like saying that a website could have two passwords on each account so if they suffer a data leak that happens to leak only one of your passwords, that wouldn't be enough to access your account?
- temp0826 5y agoCan you use 1password to act as the code generator for logging in to 1password?
- deepspace 5y agoYes. Of course, you need to be logged in on another device to do that.
- lysp 5y agoI actually do the opposite. Keep passwords on browser, and MFA on phone. If my browser / desktop got compromised, someone would still need my phone to access my accounts.
- agret 5y agoI use LastPass for password sync and Authy for 2FA. Feels a bit safer having them seperate.
- beermonster 5y agoGoogle Authenticator allows you to sync passwords between devices these days. Fairly recent(ish) and long overdue update.
- Abishek_Muthian 5y agoIsn't it just one time export which by function of TOTP is synced and not an actual sync like in 1Password? i.e. Only the accounts which were available when you exported would be there in another device.
- tomesco 5y ago1Password had a blog post [1] addressing this concern. Essentially you still have the benefit of one-timeness, but not second factor, and need to compare that to what your security needs are. [1] https://blog.1password.com/totp-for-1password-users/ https://blog.1password.com/totp-for-1password-users/