Hacker News Reader

Comment by pilif | Hacker News Reader

The problem with storing the 2FA keys in 1Password is that you're practically downgrading your account to 1FA because once 1Password is compromised, the second factor lost all of its value, though that compromise is much harder to achieve than a compromised shared machine I'm typing my password in on (which you probably also should never do).

I'm saying this as I'm looking at my 1Password database which also contains all my 2FA keys because, yes, all 2FA apps I tried so far treat these keys as way too valuable and the risk of losing them as I move from device to device is just too high.

Do as I say, not as I do I guess :p

I feel confident to rely on the security of my machine and 1Password specifically, though I am aware that I can't really claim my accounts to be secured by 2FA.

View on HN

Yes, in 1Password's 2FA announcement its head of security mentions that using 2FA in 1PW does not give you true 2FA:

> If you would like to turn a site’s offering of TOTP into true two-factor security, you should not store your TOTP secret in 1Password (or in anything that will synchronize across systems).

They mention multiple times that if you want true 2FA the second factor needs to be on a different device or a physical key like a YubiKey.

Then they say that “two-step” security offered by 1PW + 2FA is probably enough for most use cases, and that 2FA in 1PW still has additional value because (a) some sites require 2FA and (b) one-time passwords offer protection against sniffing passwords over insecure networks.

https://blog.1password.com/totp-for-1password-users/

The fact that 1PW even auto-copies the code to your clipboard after auto-filling a password so that you can paste it in when prompted raised my eyebrows when I first used the feature, though. It's very convenient but it's obvious at that point that you're throwing away the protection that storing the key on a second device would offer, even if 1PW requires you to authenticate before the app will open.

I use Lastpass for passwords and Authy for 2FA for this exact reason. If my Lastpass is compromised they only get my passwords, not my 2FA tokens. If Authy is compromised and they manage to get my 2FA backup they still don't have my passwords.

> I'm saying this as I'm looking at my 1Password database which also contains all my 2FA keys because, yes, all 2FA apps I tried so far treat these keys as way too valuable and the risk of losing them as I move from device to device is just too high.

When I set up TOTP on a site, I save the QR code as a PNG file (via the Grab application on my Mac) and the text version of the code in a text file. (If the site provided some one-time use recovery codes, those all go in the text file). Those two files go into a directory, that directory gets made into a tarball, which then gets encrypted, then stored in my "recovery" directory which later gets saved in an encrypted backup.

That's all after I scan the QR code into an authenticator app on my phone.

Moving codes to a new device is then just a matter of decrypting and extracting them from my recovery directory and scanning them on the new device.

Reply on news.ycombinator.com