Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Not really. Having your password manager store both the tokens and the password increases the odds of all your logins being compromised in one swoop. Separate them out and you’ll at least be able to hedge against some account compromises given that your 2FA solution doesn’t fall apart.

For the user it doesn’t really change much. Loss of password manager or 2FA client will lock them out of their account. This is easily hedged against because a lot of providers provide easy access to reset a password and provide backup 2FA tokens or fall over to SMS/Email tokens.



> increases the odds of all your logins being compromised in one swoop

Yes... but if someone has access to your 1Password account, they most likely gained physical access to or otherwise pwned your computer. Sure, it's slightly easier for an attacker to do that than to get 2FA tokens off your phone, if that's where you keep them.

So the increased risk of using 1Password for 2FA (given you're already using 1Password for passwords) would be roughly quantified by taking the risk of computer pwnage and subtracting the risk of phone pwnage given they already pwned your computer -- not much in my opinion, if you're reasonably security-conscious on your computer. Note that I'm ignoring the risk of 1Password's encryption being broken or insider threat at AgileBits, which in my opinion is vanishingly small at present.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: