Hacker News Reader

I use LastPass for passwords and Authy for 2FA. I like the idea that two different programs have to be attacked to get access to Google, Facebook, etc. There's a little bit more friction than having both in one program but that's the point.

Is it really 2FA if your password and your token are on the same device?

Yes. 2FA protects, among other things, against compromised passwords. Having both on the same device does not reduce this protection.

One could argue that authenticating via 1Password is already multi factor in itself e.g. Master Password is Something You Know as the first factor and access to a 1Password Vault is Something You Have as a second factor (since you cannot login to 1Password with just username and password, but also requires a Secret Key that can only be acquired from a device that already logged in).

In this case TOTP acts more like an insecure one-time session key.

Thanks I didn’t know this.