2

I was taking a look at the Dashlane site and noticed that they support two factor authentication for your password 'vault'. One of my biggest concerns surrounding using a password manager was the fact that you can use a single piece of data (your master password) to get access to every single account you have put into it.

Am I right in thinking that authenticating with something such as Google Auth or a Yubikey no longer makes your vault susceptible to being accessed by a bad actor who may have installed a keylogger or remote administration tool on your machine?

I was very interested in 1Password also but noted that they don't actually support two factor authentication in the same way. Instead they generate a 'secret key'.

Do either of the methods used by Dashlane or 1Password provide greater protection from these types of malware?

  • 1password have 2FA – user4951 Oct 2 '18 at 18:44
2

Dashlane

Dashlane has the option to use 2FA to increase the security of the users data.

At any time, a user can link his Dashlane account to a 2FA application on his mobile. When he attempts to connect into a new device, instead of sending him a One-Time Password by email, Dashlane asks the user to provide a One-Time password generated by the 2FA application.

From https://www.dashlane.com/download/Dashlane_SecurityWhitePaper_Nov2017.pdf

Not only does Dashlane use 2FA when authorizing a new device to access your account, it can also be used each time you log into your account.

This protects against malware on a user's computer from keylogging the master password and attempting to access their sensitive data. This is because in order to access the user data, a one-time password has to be provided - if a keylogger captures this one-time password when being typed it will be rendered useless for an attacker as a new one will have to be used next time.


1Password

1Password is a little different to Dashlane in that 1Password doesn't use 2FA. It uses something called a Secret Key. This Secret Key is 34 letters and numbers created by

a non-secret version setting, (“A3”), your non-secret Account ID, and a sequence of 26 randomly chosen characters.

From https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf

It has 128 bits of entropy and works alongside your master password to secure your data.

An example of a Secret Key could be A3-ASWWYB-798JRY-LJVD4- 23DC2-86TVM-H43EB. The Secret Key is generated when a 1Password account is first created and prevents an attacker who has acquired remotely stored user data from guessing the master password needed to access this data.

The Secret key is used each time you enroll a new client to your device and when you have to authenticate to the server. This can be seen again in the whitepaper for 1Password:

When enrolling a new device, the user will provide the client with the add-device link (possibly in the form of a QR code) and her Master Password. The add-device link is generated at the user’s request from an already enrolled client and includes the domain name for the team, the user’s email address, and her Secret Key.


General

An issue with 1Password is that if the secret key and master password are known, for example from a keylogger, your user data can be viewed. This is different to Dashlane as you can use a one-time password to protect your data, making keylogging ineffective.

However, Dashlane isn't secure against all types of malware. It may be susceptible to malware taking screenshots of a password being viewed in the Dashlane application, as would 1Password.

When using a password manager, you have to accept that there is the possibility of your passwords being discovered since they are stored in a place other than your head.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.