I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password.
I don't like the idea of having everything in the same place as if someone steal my 1password password it could access to my account and get both password and security tokens. Actually, I'm using the Google Auth for the 2FA and 1password for the passwords.
Is a good idea to keep them separated to increase security? Does it make any sense?
I work for 1Password, and I wrote exactly about this question when we introduced the feature.
The answer depends on what security properties you actually want from time-based one time passwords (TOTP). The "second factorness" of TOTP one of several security properties it offers, and it may be the least important in many cases. Don't get led astray that this all goes under the term "2FA", as if that is the only security benefit you get from these schemes.
So I am going to list a few of the security properties you get with TOTP and contrast them with typical password use.
Long term secret isn't transmitted during authentication. With TOTP get a long term secret that is only transmitted (typically the QR code), when you enroll. The long term secret is not transmitted when it is actually used. (This is unlike typical password usage where the password is transmitted over the net, and so depends on other protections, such as TLS). This also means that the long term secret can't be phished (although the numeric codes can be.)
Long term secret is unguessable. The long term secret is generated by the server when you first enroll, and so it is generated up to the service's standards of randomness. Again, this is unlike typical password use with human created passwords.
Long term secret is unique. You will not end up reusing the same TOTP long term secret across various services. Again, this is unlike typical password use, where people reuse passwords.
Oh yeah. And you put the long term secret on "something you have", if for some reason that is important to you.
In most cases where TOTP is deployed, it is done so because of properties #2 (unguessability) and #3 (uniqueness). Indeed, when Dropbox first introduced TOTP on their services, they spelled out their reasons as helping protect users who were reusing passwords.
After the uniqueness and unguessability of the long term secrets, the next most important benefit (for most people) is that the long term secret isn't transmitted. This makes it harder to capture on a compromised network.
Probably the least important of the security properties that TOTP gives us is the second factorness. I'm not saying that there is no benefit to it, but for the cases that most people are using TOTP, it is probably the least important.
In the above I listed four security properties of TOTP and contrasted them with typical password use. But now let's consider someone who is using a password manager to its full potential. If you are using a password manager well for some site or service4, you will have randomly generated (and so unguessable) password for that site and you will have unique password for that site. And so the use of TOTP doesn't really add a great deal in terms of those two security properties.
If we look at property #1 (long term secret not transmitted), TOTP still offer some additional security, even if you are using a password manager. However, using a password manager does reduce the chance of getting phished, and so the gain of TOTP, while real, is not as great as it would be for someone not using a password manager.
The only thing left is #4. If the two factorness really is why you value TOTP, then don't keep the long term secret in 1Password. But for most people, the value of TOTP comes from having a strong and unique long term secret that is never transmitted.
I recommend that you evaluate what you really get out of TOTP (instead of getting caught up in the whole 2FA rhetoric), and then consider the tradeoffs. I'll bet that if things like TOTP where called "Unique Secret Authentication" instead of "Two Factor Authentication" the question would never have come up.
The entire point of having a second factor for authentication is to protect you in cases where the first factor (passwords) already failed. Therefore, storing your 2FA tokens in the same place you store your passwords makes them significant less effective.
Combine that with the fact that password managers (used properly, with separate randomly-generated passwords for each account) already protect you from many of the same threats that 2FA tokens do (like brute force and credential stuffing attacks) and I begin to question why you'd bother with 2FA at all if you're going to store the tokens this way.
That said, there are some scenarios where a malicious party could steal a single password from your password manager without compromising the entire password database:
If you're not concerned with the possibility of your password database being compromised and the threat vectors I listed above sound plausible and serious enough to you to be worth the extra step of having to enter a 2FA code every time you log in, then go for it. Otherwise you may wish to store your 2FA codes separately from your password database, or forego the use of HOTP/TOTP-based 2FA tokens entirely in favor of U2F or WebAuthn tokens which offer greater protection.
I would recommend keeping the 2FA codes on 1Password, as Google Auth app does not have data backup (unless you have root and an external backup tool, such as Titanium Backup). In your case, losing your phone means losing all 2FA authentication codes you had. If you don't want to store the 2FA on 1Password, store on another application that supports cloud backup.
You will increase the security a little, because any attacker will need to compromise 2 applications, but you create another point of failure. In case of the GoogleAuth app, losing your phone can potentially lock you out of some accounts.
I would create a secure, long and unique password and use only one password manager.
Assuming you are talking about the emergency codes and / or the ability to get back your two factor on a new device I personally find it quite disconcerting to have those codes available anywhere online. This is a perfect case for offline backups.
Keeping a copy of the qr code / recovery key / etc offline (either on paper, or on a USB stick) is my preference. A personal favorite (assuming a Windows PC) is a bitlocked USB stick, kept in a safety deposit box.
Ideally
In an ideal world you should have your second factor keys on exactly ONE device. That way it can truly be something you have (in addition to the something you know like your password). By having your keys on your phone which is protected by a PIN or other security, when you lose your phone you can remotely wipe the phone and be certain that the codes have not escaped.
But that is FAR from realistic...
In the real world we need backups. Yes, you could store your info in 1Password (or any password manager) and you would still be more secure than the average person (making you a much less likely target). So if the decision is no backups vs storing in 1Password, then store in 1Password.
However, like you mention, it is putting all of your eggs in one basket. If your 1Password vault is breached somehow, you are screwed.
So what I suggest (which Tim mentioned here as well) is to store your second factor codes on something ENTIRELY DIFFERENT than your 1Password. Whether it is by printing them out, loading them on a secondary phone, using a service like Authy (which has backups), or anything else. Then you have two points of failure. Someone can get in to your 1Password and still not have access to our multi-factor accounts.
Personally love the printing suggestion here. By printing the code you are entirely removing it from your digital life so no hacker is going to be able to get to them. Lock them in a safe, put them in a safety deposit box. Anything. And then it is easy to load up a new phone with codes when you inevitably lose your phone or need to upgrade.
TL;DR: By having a second factor, you are already miles ahead of the pack. So securing them in 1Password can be thought of as a calculated risk and, while not perfect, is still reasonably secure. However, in pursuit of a more perfect security model, store them separately and preferably air-gapped from the internet so a hacking attempt won't be able to get your 1Password AND your security codes all at once.
Well, the simple answer is Yes. Despite all the trust we have in the password managers, it's a good idea to practice defence in depth. The reason you have 2FA is to add that extra layer of security to augment the password. It defeats the purpose if that same password is stored along with the second factor. Security is the principle of always thinking secure.
