31–40 of 406 posts
It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone. This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single…
>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.
I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…
* Search is just plain broken. This was the number one reason i scrapped it. * Managing multiple vaults (i have over a dozen) is unusable. * The UI is terrible, it takes way more space to show less information than 7. * The browser integration (FF) seemed to work poorly.
Basically, once 1Password stops supporting 7, they will have lost me and anyone I can influence as a customer.
It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone. This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single…
I’ve been treating SSH keys in the same way I would a password. Each service gets a new key generated for it. From doing some reading though it sounds like I might be wasting my time. Apparently it’s fine to have one key for an individual machine and to use that for everything. What’s everyone else’s take on that? Are you reusing a single key or generating each time?
If something more robust is needed, ssh certs and principals can be used.
Some use Pam modules to require 2nd factor too.
It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone. This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single…
You can use a Yubikey for 2fa with 1Password
However, for those reading along, initially the 1Password web interface for my account only offered the choice of setting up a TOTP authenticator. I completed that, and still saw no option for enabling a FIDO/YubiKey device. I then went into the 2FA settings for my account, toggled the option for YubiKey support off and then on again, and returned to the 2FA settings page. Only then did I see the option to enable a YubiKey.
I was then able to add my YubiKey and I can confirm that it's working with my 1Password account as a 2FA source.
It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone. This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single…
You can use a Yubikey for 2fa with 1Password
At that point though, you already have a hardware token capable of holding SSH keys, so I'm still not convinced of the benefit.
It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone. This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single…
1p has some native support for hardware keys ( https://support.1password.com/security-key/ ), but you can always use Yubico Authenticator for any applications that force you to use TOTP.
>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.
I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…
Earlier quoted context omitted.
I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…
I tried 8 on Windows. I went back to 7 after a week. * Search is just plain broken. This was the number one reason i scrapped it. * Managing multiple vaults (i have over a dozen) is unusable. * The UI is terrible, it takes way more space to show less information than 7. * The browser integration (FF) seemed to work poorly. Basically, once 1Password stops supporting 7, they will have lost me and anyone I can influence…
FWIW, my main gripe is having to unlock each vault separately, as opposed to a single unlock as used to be the case on Mac / iPhone.