3 ms·

Use 2FA in your password manager. Most support it.

by gjsman-1000 3y ago

IshKebab 3y ago
How does that work? Isn't the second factor normally a text message to your phone?
- abrahms 3y ago
  It isn't a true second factor. See here for a discussion on it: https://www.reddit.com/r/1Password/comments/1247mho/help_with_changing_from_1password_2fa_to_third/ https://www.reddit.com/r/1Password/comments/1247mho/help_wit...
- TheSwordsman 3y ago
  It's extremely risky to use MFA via text messages, due to the commonality of SIM swap attacks. Attacker calls your cell phone provider, executes a social engineering attack to authenticate as you, and can now route your phone calls and text messages to a device they own. It's a good idea to avoid SMS/Phone MFA. If you use a token generator (Google Authenticator, Authy, or the one built into products like 1Password), a shared secret key is used to generate the MFA token. You store this secret in that software, and it uses the current time + that secret key to generate the MFA token. This is a far better mechanism than the SMS or phone call based approach. And in this mechanism you can store the secret in any software that's able to generate the token using that algorithm. Most commonly it's this algorithm: https://datatracker.ietf.org/doc/html/rfc6238 https://datatracker.ietf.org/doc/html/rfc6238
- bluehatbrit 3y ago
  GitHub and many other sites support TOTP 2FA. These create a key which is used by an TOTP app to generate a time based code which is used. This is generally considered better than SMS codes as it's harder for someone else to hijack. There are loads of TOTP apps, Google Authenticator is a popular one, but lots of password managers like 1Password and co also support it. I use my password manager for 2FA for low value accounts. High value ones I use a separate mobile app. I only use SMS when the service forces me to because they don't support anything else. The risk here is of course that if your password manager is compromised, your second factor has no security value. For some cases people might be okay with that. In many cases I'm more concerned about a password being leaked rather than my password manager being compromised. For anything with significant value to me, I use a separate 2FA app though. In this case if my password manager was compromised, 2FA gives me some added security.

Use 2FA in your password manager. Most support it.

IshKebab 3y ago

How does that work? Isn't the second factor normally a text message to your phone?

abrahms 3y ago
It isn't a true second factor. See here for a discussion on it: https://www.reddit.com/r/1Password/comments/1247mho/help_with_changing_from_1password_2fa_to_third/ https://www.reddit.com/r/1Password/comments/1247mho/help_wit...
TheSwordsman 3y ago
It's extremely risky to use MFA via text messages, due to the commonality of SIM swap attacks. Attacker calls your cell phone provider, executes a social engineering attack to authenticate as you, and can now route your phone calls and text messages to a device they own. It's a good idea to avoid SMS/Phone MFA. If you use a token generator (Google Authenticator, Authy, or the one built into products like 1Password), a shared secret key is used to generate the MFA token. You store this secret in that software, and it uses the current time + that secret key to generate the MFA token. This is a far better mechanism than the SMS or phone call based approach. And in this mechanism you can store the secret in any software that's able to generate the token using that algorithm. Most commonly it's this algorithm: https://datatracker.ietf.org/doc/html/rfc6238 https://datatracker.ietf.org/doc/html/rfc6238
bluehatbrit 3y ago
GitHub and many other sites support TOTP 2FA. These create a key which is used by an TOTP app to generate a time based code which is used. This is generally considered better than SMS codes as it's harder for someone else to hijack. There are loads of TOTP apps, Google Authenticator is a popular one, but lots of password managers like 1Password and co also support it. I use my password manager for 2FA for low value accounts. High value ones I use a separate mobile app. I only use SMS when the service forces me to because they don't support anything else. The risk here is of course that if your password manager is compromised, your second factor has no security value. For some cases people might be okay with that. In many cases I'm more concerned about a password being leaked rather than my password manager being compromised. For anything with significant value to me, I use a separate 2FA app though. In this case if my password manager was compromised, 2FA gives me some added security.