I use 1Password but enable 2FA anywhere I can. If you can store your 2FA keys in 1Password, you're not really doing 2FA.
(The distinction may not matter much in practice!)
(The distinction may not matter much in practice!)
Why? What is the threat vector whereby you think 1Password would be compromised but an OTP system would still be secure?
> If you can store your 2FA keys in 1Password, you're not really doing 2FA.
I know. (That's why I said doing so is "bringing it back down to 1 factor.")
That can't happen to a properly designed physical token, and even though it can happen to a phone token, it's less likely to happen, because (at least in the iOS case) your phone is hardened much, much more severely than your OS X kernel.
Right, but at that point the account is effectively already compromised.
Even if I have a second factor, they can just piggyback on the session I create when logging in via that second factor.
Sadly, the sites which I would most like to secure in this way (ie. important but I don't use often) invariably are stuck with ancient authentication technology.
Having 2FA within the Google Auth app on my phone prevents this from happening, effectively turning my password into a rotating 6 digit key instead of 32 character nonsense.
I can think of a few examples of threat vectors where an attacker could get one of my passwords without being able to completely take over any of my devices.
1. There might be a browser vulnerability that allows a malicious web page to get one of my passwords - let's say it gets to read memory that was deallocated but not zeroed, or it gets to see the contents of my clipboard, or something like that.
2. The provider of the service I'm using might accidentally leak some of their passwords. In the worst case, they might not even notice it.
3. In some special circumstances I might have to check my mail on a computer that I don't own, and there might be a keylogger.
I don't necessarily consider these threats to be very likely, but I get new devices so rarely, that even a minor improvement in security makes it is worth the inconvenience for me.
Do you store TOTP tokens in one app, and passwords in 1Pass? Do you use SMS? With Yosemite, these are often setup to sync to show up across all your devices..
I'm not super comfortable with SMS authentication but use it for lower-value stuff.