Where does non-repudiation fit in if multiple people get the same 2FA code?
You're trusting teamFA, Slack, and each team member's Slack accounts. This seems like a security nightmare.
Show HN: Generate shared 2FA codes for your entire team
31–40 of 43 posts
Re: Show HN: Generate shared 2FA codes for your entire team
#32Can't the login with 2FA be shared with the team in 1Password, because 2FA alone is not enough to share a login. Not that sharing logins is a smart thing to do, but people still do it to go around per-seat pricing.
Re: Show HN: Generate shared 2FA codes for your entire team
#33This works around a real problem I'm surprised nobody has solved - the ability to register a bunch of keys at the same time.
The webauthn spec has public/private keys incorporated: https://www.w3.org/TR/webauthn-2/#sctn-sample-registration
There should be no risk to storing all your public keys in e.g. 1password. When signing up for e.g. facebook.com, you should be able to hit a button and have all your keys registered at the same time. You can send $site all your public keys, and sign auth reqs as you log in. Of course, the UX would be handled by webauthn, so you'd really just be tapping your yubikey or scanning your fingerprint on login.
Ideally, password managers would offer key servers that websites could hit in real-time to pull your public keys. That's probably a stretch - maybe websites could sync your 2fa pub keys in the background.
With such a model:
1. Having multiple yubikeys
2. Having multiple team members with access (same as 1, effectively)
3. Revocation of individual 2fa devices
4. Adding 2fa devices after account creation
Would be pretty trivial.
I assume there's something basic in the webauthn protocol that I'm overlooking that prevents such a model. What is it, and why can't we have these properties?
I for one don't want all my accounts to hinge on access to a single physical device, and I certainly don't want to register 10 yubikeys with every service (some I may not even have physical access to on a day-by-day basis).
Re: Show HN: Generate shared 2FA codes for your entire team
#34Totally get the use case for this, lots of shared accounts in IT, been a problem for years that gets solved in a number of ways. Sometimes clever, sometimes barely duct tape. This is much nicer looking. But... and it's a very big but... why would you trust this service? You're giving random person on the internet your 2FA secret keys. Their TOS & PP don't even mention encryption. I'm not saying you can't do something…
Of the two 1password for teams is much better, the user interface on LastPass Enterprise is this horrid monstrosity that keeps flipping you between web pages and a native interface for basic account maintenance. 2FA required a separate client altogether though they might have integrated it just as I was saying goodbye. In 1password it is seamless.
Re: Show HN: Generate shared 2FA codes for your entire team
#35Would recommend hashi vault in place of this which can work for human/non-human workflows and a pretty robust security model with better auditing and authorization than slack. https://www.vaultproject.io/docs/secrets/totp
Re: Show HN: Generate shared 2FA codes for your entire team
#36This is absolutely perfect for a use case that I've seen a lot: shared test accounts. Eg our app connects to external service X, so we have a staging account set up such that the staging version of our app can operate. But service X values security and requires 2fa on all accounts. This is really annoying, especially if service X is expensive and charges per seat. We don't want to pay for a seat for all of our develo…
Do you know 1password handles storing mfa codes?
I thought 1password only allows storing MFA codes for pre-determined sites? Eg it doesn't provide a MFA option for microsoftonline.com.
Re: Show HN: Generate shared 2FA codes for your entire team
#37Earlier quoted context omitted.
The use case seems to be to bypass any value provided in using 2FA in the first place...
Using a separate device (yubikey, mobile phone, etc) is always recommended, but this is a bit more secure than meets the eye. Someone would have to get access to your Slack account to view the codes, and to do that, they'd have to first get access to your work email (because Slack is password-less and emails auth links to you).
To do this semi-securly (because slack accepts regular passwords) you'd need validate the user's own mfa before handing out these mfa creds to prevent a slack account compromise from escalating... but slack can't do that unless there was an extension in the plugin somehow to prompt for an otp code.
Re: Show HN: Generate shared 2FA codes for your entire team
#38Earlier quoted context omitted.
Do you know 1password handles storing mfa codes?
I thought 1password only allows storing MFA codes for pre-determined sites? Eg it doesn't provide a MFA option for microsoftonline.com.
It prompts for some sites (using some .well-known URL protocol?). But I recently learned you can add the "One Time Password" field type to any Login entry manually. I do it all the time for intranet/test sites that need MFA and I have done it with sites that didn't prompt that are shared in our family (home) and team (work) 1Password vaults. The field time lets you scan a QR code or enter the seed key manually
Re: Show HN: Generate shared 2FA codes for your entire team
#39Earlier quoted context omitted.
I thought 1password only allows storing MFA codes for pre-determined sites? Eg it doesn't provide a MFA option for microsoftonline.com.
It prompts for some sites (using some .well-known URL protocol?). But I recently learned you can add the "One Time Password" field type to any Login entry manually. I do it all the time for intranet/test sites that need MFA and I have done it with sites that didn't prompt that are shared in our family (home) and team (work) 1Password vaults. The field time lets you scan a QR code or enter the seed key manually
Huh that's awesome I didn't know it had that feature. Cheers!
Re: Show HN: Generate shared 2FA codes for your entire team
#40Bitwarden, and the fantastic rust-built equivalent Vaultwarden can be self-hosted, include granular, multi-user sharing of credentials which may contain TOTP secrets.
The web GUI, various plug-ins, and apps can all then generate the TOTP codes.