1Password and 2FA: Is it wrong to store passwords and one-time codes together? (2023)

Re:1Password and 2FA: Is it wrong to store passwords and one... by danieldk on Saturday July 06, 2024 @03:07AM (#40888677)

But there are other scenarios where your password could be stolen without someone getting access to your 1password, for instance if your connection isn't protected and a man in the middle can intercept your password.

Then they could also intercept your TOTP code, which is valid for a pretty long time by default (remember that the TOTP code is accepted for some time after the counter goes to 0 to account for transmission delays, slightly out of sync clocks, etc.) and use that to log into your account.

TOTP does not protect against modern forms of phishing. You need something like FIDO2.

[ Parent | on HN ]

Re:1Password and 2FA: Is it wrong to store passwords and one... by goupil on Saturday July 06, 2024 @06:37AM (#40889523)

That's a very valid point, as an automated attack could then be performed. I guess it would at least help against an attacker that would be manually checking what's inside the packets captured, or that would let his attack passively capture everything for a while and then proceed to attack.

[ Parent | on HN ]

Re:1Password and 2FA: Is it wrong to store passwords and one... by antonellaleo on Thursday July 11, 2024 @05:53PM (#40940941)

In recent times,technology has proven to be more sophisticated and just like any other currency that can be stolen or lost,crypto and other digital assets has proven to be more difficult to recover but not impossible, and just like searching for any other monetary currency, you need a trustworthy and honest agency or personnel who can track and recover the value lost or stolen,in my case I hired easyreclaimer@gmailcom, they followed the blockchain and was able to recover over 247k of my stolen funds within a couple of weeks. The fees for the services I received was fair and communication was excellent

[ Parent | on HN ]