Dashlane
Dashlane has the option to use 2FA to increase the security of the users data.
At any time, a user can link his Dashlane account to a 2FA application
on his mobile. When he attempts to connect into a new device, instead
of sending him a One-Time Password by email, Dashlane asks the user to
provide a One-Time password generated by the 2FA application.
From https://www.dashlane.com/download/Dashlane_SecurityWhitePaper_Nov2017.pdf
Not only does Dashlane use 2FA when authorizing a new device to access your account, it can also be used each time you log into your account.
This protects against malware on a user's computer from keylogging the master password and attempting to access their sensitive data. This is because in order to access the user data, a one-time password has to be provided - if a keylogger captures this one-time password when being typed it will be rendered useless for an attacker as a new one will have to be used next time.
1Password
1Password is a little different to Dashlane in that 1Password doesn't use 2FA. It uses something called a Secret Key. This Secret Key is 34 letters and numbers created by
a non-secret version setting, (“A3”), your non-secret Account ID, and
a sequence of 26 randomly chosen characters.
From https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf
It has 128 bits of entropy and works alongside your master password to secure your data.
An example of a Secret Key could be A3-ASWWYB-798JRY-LJVD4-
23DC2-86TVM-H43EB. The Secret Key is generated when a 1Password account is first created and prevents an attacker who has acquired remotely stored user data from guessing the master password needed to access this data.
The Secret key is used each time you enroll a new client to your device and when you have to authenticate to the server. This can be seen again in the whitepaper for 1Password:
When enrolling a new device, the user will provide the client with the
add-device link (possibly in the form of a QR code) and her Master
Password. The add-device link is generated at the user’s request from
an already enrolled client and includes the domain name for the team,
the user’s email address, and her Secret Key.
General
An issue with 1Password is that if the secret key and master password are known, for example from a keylogger, your user data can be viewed. This is different to Dashlane as you can use a one-time password to protect your data, making keylogging ineffective.
However, Dashlane isn't secure against all types of malware. It may be susceptible to malware taking screenshots of a password being viewed in the Dashlane application, as would 1Password.
When using a password manager, you have to accept that there is the possibility of your passwords being discovered since they are stored in a place other than your head.
