Hacker News Reader

Comment by tshaddox | Hacker News Reader

I use 1Password for all of my MFA codes on the web. It's extremely convenient to have them synced across all my devices, but I can't help but think that having my passwords and my MFA private keys stored in the same place almost entirely defeats the purpose of multi-factor authentication.

View on HN

If your passwords are leaked in a data leak, they still wouldn't get your 2FA. So I wouldn't say it entirely defeats the purpose of 2FA.

Depending on the leak, the secret that drives TOTP could also be in the same database table (or a nearby one). This means anybody with that secret can trivially run the TOTP algorithm and get the correct six digit code for any time present or future.

If you care about MFA that can survive leaks, you want WebAuthn. As with phishing this known problem was considered in the design of WebAuthn and so your WebAuthn credentials aren't designed to need to be secret.

In fact here you go, here are WebAuthn credentials for a vanity system I own, copied out of its authentication database:

ID: AXnUJ920FfJlRjZtocN+9Bc9IP6gvsBiWA3GfJxckh3nQ/KekQ6xB2byfI2GM7IcGS2MpzxZs6IHmAxvgAcE/Mw= Public key: pQECAyYgASFYIFf0iDSfNpYNA5Br9zXSIUH69BqyvFcgbqy6tWC8rsLwIlggCDqury9UOzI1DnOFyE3aYwaBLvP0NyNez98v0TcieKs=

That's all the backend needs to check I'm really me, and yet it's also completely useless to an attacker, they can't even use it to compare across sites and "unmask" me.

WebAuthn is great. Put it to work recently in a new control system and it sure is a nice feeling to deploy with zero need for passwords.

I had a quick look on wikipedia about how webauthn works, looks like you use a hardware (USB?) device to sign something with the PIN you enter.

What happens if you lose that device, or if it fails?

If they stored my password in plain text, I'm not sure I would trust their 2FA implementation to actually function as a second factor to protect my account. :) Seriously though, isn't this a little like saying that a website could have two passwords on each account so if they suffer a data leak that happens to leak only one of your passwords, that wouldn't be enough to access your account?

I actually do the opposite.

Keep passwords on browser, and MFA on phone.

If my browser / desktop got compromised, someone would still need my phone to access my accounts.

That's like the definition of 2FA/MFA

Sounds like they're doing it properly then!

1Password had a blog post [1] addressing this concern. Essentially you still have the benefit of one-timeness, but not second factor, and need to compare that to what your security needs are.

[1] https://blog.1password.com/totp-for-1password-users/

There is still a little bit of a point, as it guarantees the password came out of 1Password and wasn't from somewhere else. If someone screencapped your password out of 1Password, it wouldn't of use unless they could get into your vault somehow.

I use LastPass for password sync and Authy for 2FA. Feels a bit safer having them seperate.

Google Authenticator allows you to sync passwords between devices these days. Fairly recent(ish) and long overdue update.

Isn't it just one time export which by function of TOTP is synced and not an actual sync like in 1Password? i.e. Only the accounts which were available when you exported would be there in another device.

Can you use 1password to act as the code generator for logging in to 1password?

Yes. Of course, you need to be logged in on another device to do that.

Reply on news.ycombinator.com