Hacker News Reader

If you have 1Password it supports OTP and thus can be used across devices.

LastPass has this too I think. But something seems off to me storing my 2FA with the service that manages my first factor.

YubiKeys can store and access OTP secrets. I put the secret in both Google Authenticator and my YubiKeys as backup.

Lastpass categorically does not have this. We could find no way to use it to share TOTP among administrators for a root account for example.

They refused a refund as well.

Horrifically bad company customer service, UX, UI. Save yourself the trouble and skip them, call 1Password.

Whenever discussing this with colleagues there’s always been a bit of debate about whether OTP inside 1password constitutes 2FA or not.

On the one hand a password could be popped from the target site or phishing, and you’d still need the 2nd factor from 1password to get in.

But on the other hand, if you leave your phone lying around unlocked with a poor master password, both get popped together.

If you leave your phone unlocked with Google Authenticator / SMS 2fa and a weak master password, you still get popped. The only difference to me in convenience of 2fa code auto fill.

Reply on news.ycombinator.com