{"id":39990,"date":"2023-07-07T14:14:14","date_gmt":"2023-07-07T18:14:14","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=39990"},"modified":"2023-07-11T11:48:09","modified_gmt":"2023-07-11T15:48:09","slug":"is-it-safe-to-store-passwords-and-2fa-codes-together","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2023\/07\/07\/is-it-safe-to-store-passwords-and-2fa-codes-together\/","title":{"rendered":"Is It Safe to Store Passwords and 2FA Codes Together?"},"content":{"rendered":"

Megan Barker<\/a>:<\/p>\n

\n

It’s important to acknowledge that 2SV is a very valid way to secure your accounts, and improves upon the standard use of a username and password (one-factor authentication). The additional required step can prevent account compromise by someone who gains access to your login information; it acts as a barrier regardless<\/em> of TOTP location.<\/p>

But there’s an incredibly specific (and unlikely) scenario in which storing your TOTP in a separate authenticator app may<\/em> offer additional protection. If an attacker got ahold of your 1Password login information (and<\/em> your 2FA secret if you’ve added that layer of protection to your 1Password account) but didn’t<\/strong> have control of your device, the separation between your passwords and TOTP could<\/em> prove useful.<\/p>\n

I hedged with may<\/em> and could<\/em> because this theoretical attacker who somehow gained access to your 1Password sign-in details would know your email address, Secret Key, and account password (at minimum). Anyone with the ability to gather that much sensitive intel is unlikely to see an authenticator as much of a challenge. And, to my knowledge, there’s no authenticator app or password manager on the market that can safeguard data on a compromised device<\/a>.<\/p>\n<\/blockquote>\n\n

Previously:<\/p>\n