Hacker News Reader

Comment by philliphaydon | Hacker News Reader

There’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…

View on HN

So that you're protected from data breaches of the service itself (e.g. revealing a reused password)

That doesn't have anything to do with MFA. If for some reason your 1Password masterpass is compromised, the hacker has access to your passwords and your MFA tokens.

If you use 1Password and say Authy (Assuming your Authy pass isn't in 1Password) or Google Authenticator. Then all services with MFA wont be compromised if the 1Password masterpass is...

Hi there!

Not quite. An attacker would need either your account password AND an already authorized device, OR they would need both your account password AND Secret Key. If you have 2FA enabled for your 1Password account, and the attacker doesn't have one of your authorized devices, they would also need your second factor (TOTP or hardware key).

Additionally our Principal Security Architect, Jeff Goldberg, wrote some thoughts on this subject, here: https://blog.1password.com/totp-for-1password-users/

- Ben, 1Password

So you're banking on the idea that in order to login to 1Password you need an authorized device as your layer of security.

I used to think that way but then I had a phone die and lost my Google Authenticator - I lose access to many servivces and had to go through the pain of resetting so many MFAs.

Then I was like "1Password will sync these to my new phone so I never lose access to everything again? Fine."

I also started to get questions from my wife around how she could access things in the event of my death and it seemed having a 1Password printout in a safe deposit box she could access - and having that include the MFA too - was a good idea.

My master password in 1Password is quite secure (A long obscure sentence and with special characters etc.), I have it auto-lock pretty quickly (thanks TouchID!) and I guess that will have to be enough unless I shift to something like a Yubikey on my keychain for things down the road...

The benefit over SMS or Authenticator apps is that it doesn't pre-fill codes (and passwords) if the URL doesn't match. But yeah, I also have mixed feelings about it. Just slightly better than SMS maybe.

The point is to have the same amount of security of a strong password, with the same amount of hassle as a strong password.

Not every little SaaS needs MFA.

Passwords are not "real" secrets. Don't put real secrets into password managers.

Reply on news.ycombinator.com