[ARIN-consult] increasing 2FA take-up

[Scott Leibrand]

I use 1Password with a local vault, not their new cloud-based service
(which has more account-recovery options, for better or for worse). My two
factors are possession of my 1Password vault and knowledge of the master
password to it. So the point of 2FA is not defeated by that setup, just
delegated. The end result is more secure than SMS 2FA using a password I
have to remember (and might mistype into a phishing site).

-Scott

On Wed, May 25, 2022 at 10:01 AM William Herrin <bill at herrin.us> wrote:

> On Wed, May 25, 2022 at 8:40 AM Scott Leibrand <scottleibrand at gmail.com>
> wrote:
> > Putting TOTP in 1Password makes login far more convenient than SMS 2FA,
> and almost as convenient as password-only, even for shared accounts.
>
> Hi Scott,
>
> Putting TOTP in 1Password alongside your actual password reduces it to
> 1-factor authentication: access to 1Password. That both defeats the
> point of two factor authentication and makes your ARIN access
> dependent on a third party (1Password).
>
> Regards,
> Bill Herrin
>
> --
> William Herrin
> bill at herrin.us
> https://bill.herrin.us/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-consult/attachments/20220525/4097957f/attachment.htm>