5 ms·

> Sadly I have switched away to 1P, too much effort to move it all back. It seems like a very, very bad thing to store both your passwords, and TOTP codes in t

> Sadly I have switched away to 1P, too much effort to move it all back. It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool...

bdcravens 3y ago
I agree, and I'm a huge 1Password fan. I use Authy instead, which also backs up TOTPs. I'm also having the same thoughts about Google Auth: my email (Gmail) is a big target for gaining access to the rest of my digital life, and putting 2FA in the same hands seems risky. I'd need to do more evaluation to consider leaving Authy.
psanford 3y ago
The main point of TOTP is that users passwords are mostly weak and reused across sites. TOTP protects those users from password stuffing and similar attacks. If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. So for most folks it is just fine to store you TOTP seed in 1PW. Unlike TOTP, passkeys _do_ buy you additional security in their phishing resistance. So you should always prefer passkeys/fido2 keys to TOTP if that is an option. Its still fine for most users to use 1PW as your passkey storage.
- xyzzy_plugh 3y ago
  Furthermore the risk exposure to using TOTO in 1pw is almost insignificant. You can configure your 1password account to require 2FA when setting up new devices, and unlike Google here the decryption requires manual knowledge not shared with the cloud. The only argument I can imagine is that if someone gets ahold of your phone it's either locked and they can unlock it or it's unlocked, in which case either your 1pw account and/or other TOTP apps are either locked or unlocked. In the worst case scenario where everything is unlocked, having a separate app is negligible. Besides, AFAIK Google Authenticator doesn't require additional unlock steps, unlike authy or 1password. You're better off worrying about how to avoid TOTP and securing 1password than about having TOTP codes stored alongside your passwords.
- tasuki 3y ago
  > If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. Why isn't TOTP buying much additional security? It seems to me that apart from password reuse it's mitigating many other potential problems: keyloggers leaking passwords from your device, passwords leaking from the authenticating server, etc.
  - lll-o-lll 3y ago
    Totp seeds leak from servers just as easily as passwords do.
    - computerfriend 3y ago
      One way passwords leak from servers is when they're being inappropriately logged (like at the POST-level), which is not going to happen for TOTP seeds.
      - lll-o-lll 3y ago
        True enough. However, unlike a password, you can’t take a hash of it and thus reduce the consequence of exposure. It’s just another shared secret, albeit one that doesn’t rely on the fallibility of human creation. The only good solution is WebAuthn and related technologies (phone passkeys for disaster recovery), so that server side needs nothing more than a public key.
  - tedd4u 3y ago
    Not exactly the question you asked but one reason FIDO/Ubikey provides more protection than TOTP is that it won't send codes to the wrong website. If you're being phished skillfully, and don't notice the URL is wrong, you're protected in that way. If you use TOTP you have to verify the URL manually.
- Takennickname 3y ago
  It literally protects you from key loggers. Isn't that important?
  - psanford 3y ago
    In practice, no. Key loggers are a minuscule threat to account security compared to weak passwords and password reuse. But lets say you are in fact a user that gets targeted by an adversary capable of deploying a key logger against you. Does TOTP protect you? No! If you are compromised to that point, the attacker is also in a position to just hijack your sessions. There isn't a threat model out there that is trying to solve the problem of "my end user device has been compromised but I still want to be able to use it to access sensitive systems without those systems being compromised."
    - hirsin 3y ago
      Token binding was the closest we had - still lets a compromised endpoint in the right position steal and use the tokens from that device, but it's at least not persistent.
    - Takennickname 3y ago
      True
    - NoZebra120vClip 3y ago
      Keyloggers may not threaten people who habitually use personal devices, but I can see them still looming large for those who rely on public computers, in libraries, schools, coworking spaces, etc. YMMV.
r00fus 3y ago
As a former Google Auth user, who bungled my own phone migration a few years ago - yeah, defense in depth is better but at the time, I was furious there was no way to recover my Google Auth and I had to go to every single service and reset my 2FA. Storing both on 1Pass is not as secure, but the option is that once in a while you misstep and spend a week restoring TOTP setup (or lose entire accounts because your service provider has no functional customer support) then I'm amenable to stable but less secure options.
nighthawk454 3y ago
Eh, it's still better than not having it. Which is likely the bar for a lot of casual users. Mostly the goal is to prevent password reuse I think, which comes down to convenience. And unless 1pass gets hacked (which could happen! see: LastPass) it's relatively secure for that purpose.
roopakv 3y ago
Very true, however as others have pointed out it all comes down to levels of security. There are many non important accounts where I have 2FA, and both the password and the TOTP is in 1p. This should suffice for any brute force password attacks. However there are some accounts (like google) which one can consider more important for which I keep the TOTP on a separate app like Authy. More recently I've been switching to yubikeys where possible.
unethical_ban 3y ago
I'm more concerned about the one tool being cloud-based than anything. I keep my 2fa backup codes in my Keepass safe. Where else will I keep them?
jwr 3y ago
> It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool Yes. It defeats the purpose. But whenever you mention it, you will get lots of replies with plenty of hand-waving why this is still better and why it doesn't matter "much". If you go to the effort of doing 2FA, do it right. Two Yubikeys, and a reasonably decent TOTP app (Authy qualifies as "reasonable") for those sites that do TOTP.

> Sadly I have switched away to 1P, too much effort to move it all back. It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool...

bdcravens 3y ago

I agree, and I'm a huge 1Password fan. I use Authy instead, which also backs up TOTPs. I'm also having the same thoughts about Google Auth: my email (Gmail) is a big target for gaining access to the rest of my digital life, and putting 2FA in the same hands seems risky. I'd need to do more evaluation to consider leaving Authy.

psanford 3y ago

The main point of TOTP is that users passwords are mostly weak and reused across sites. TOTP protects those users from password stuffing and similar attacks. If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. So for most folks it is just fine to store you TOTP seed in 1PW. Unlike TOTP, passkeys _do_ buy you additional security in their phishing resistance. So you should always prefer passkeys/fido2 keys to TOTP if that is an option. Its still fine for most users to use 1PW as your passkey storage.

xyzzy_plugh 3y ago
Furthermore the risk exposure to using TOTO in 1pw is almost insignificant. You can configure your 1password account to require 2FA when setting up new devices, and unlike Google here the decryption requires manual knowledge not shared with the cloud. The only argument I can imagine is that if someone gets ahold of your phone it's either locked and they can unlock it or it's unlocked, in which case either your 1pw account and/or other TOTP apps are either locked or unlocked. In the worst case scenario where everything is unlocked, having a separate app is negligible. Besides, AFAIK Google Authenticator doesn't require additional unlock steps, unlike authy or 1password. You're better off worrying about how to avoid TOTP and securing 1password than about having TOTP codes stored alongside your passwords.
tasuki 3y ago
> If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. Why isn't TOTP buying much additional security? It seems to me that apart from password reuse it's mitigating many other potential problems: keyloggers leaking passwords from your device, passwords leaking from the authenticating server, etc.
- lll-o-lll 3y ago
  Totp seeds leak from servers just as easily as passwords do.
  - computerfriend 3y ago
    One way passwords leak from servers is when they're being inappropriately logged (like at the POST-level), which is not going to happen for TOTP seeds.
    - lll-o-lll 3y ago
      True enough. However, unlike a password, you can’t take a hash of it and thus reduce the consequence of exposure. It’s just another shared secret, albeit one that doesn’t rely on the fallibility of human creation. The only good solution is WebAuthn and related technologies (phone passkeys for disaster recovery), so that server side needs nothing more than a public key.
- tedd4u 3y ago
  Not exactly the question you asked but one reason FIDO/Ubikey provides more protection than TOTP is that it won't send codes to the wrong website. If you're being phished skillfully, and don't notice the URL is wrong, you're protected in that way. If you use TOTP you have to verify the URL manually.
Takennickname 3y ago
It literally protects you from key loggers. Isn't that important?
- psanford 3y ago
  In practice, no. Key loggers are a minuscule threat to account security compared to weak passwords and password reuse. But lets say you are in fact a user that gets targeted by an adversary capable of deploying a key logger against you. Does TOTP protect you? No! If you are compromised to that point, the attacker is also in a position to just hijack your sessions. There isn't a threat model out there that is trying to solve the problem of "my end user device has been compromised but I still want to be able to use it to access sensitive systems without those systems being compromised."
  - hirsin 3y ago
    Token binding was the closest we had - still lets a compromised endpoint in the right position steal and use the tokens from that device, but it's at least not persistent.
  - Takennickname 3y ago
    True
  - NoZebra120vClip 3y ago
    Keyloggers may not threaten people who habitually use personal devices, but I can see them still looming large for those who rely on public computers, in libraries, schools, coworking spaces, etc. YMMV.

r00fus 3y ago

As a former Google Auth user, who bungled my own phone migration a few years ago - yeah, defense in depth is better but at the time, I was furious there was no way to recover my Google Auth and I had to go to every single service and reset my 2FA. Storing both on 1Pass is not as secure, but the option is that once in a while you misstep and spend a week restoring TOTP setup (or lose entire accounts because your service provider has no functional customer support) then I'm amenable to stable but less secure options.

nighthawk454 3y ago

Eh, it's still better than not having it. Which is likely the bar for a lot of casual users. Mostly the goal is to prevent password reuse I think, which comes down to convenience. And unless 1pass gets hacked (which could happen! see: LastPass) it's relatively secure for that purpose.

roopakv 3y ago

Very true, however as others have pointed out it all comes down to levels of security. There are many non important accounts where I have 2FA, and both the password and the TOTP is in 1p. This should suffice for any brute force password attacks. However there are some accounts (like google) which one can consider more important for which I keep the TOTP on a separate app like Authy. More recently I've been switching to yubikeys where possible.

unethical_ban 3y ago

I'm more concerned about the one tool being cloud-based than anything. I keep my 2fa backup codes in my Keepass safe. Where else will I keep them?

jwr 3y ago

> It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool Yes. It defeats the purpose. But whenever you mention it, you will get lots of replies with plenty of hand-waving why this is still better and why it doesn't matter "much". If you go to the effort of doing 2FA, do it right. Two Yubikeys, and a reasonably decent TOTP app (Authy qualifies as "reasonable") for those sites that do TOTP.