1Password sort of supports 2FA. We have a master password and an additional secret. But why don't they support TOTP for 2FA?

I just want to make really sure that unless I approve, no other devices can access my 1Password account.

Say someone put a trojan keylogger on my computer. I don't know if I can ever detect the presence of this on my current computer.

Say I open 1Password in my computer. It asks for master password that I type and I insert the key. Now, since one of my computers is compromised, the hacker knows my master password and my secret key that is not regularly changed. Isn't that dangerous?

LastPass implements 2FA, it supports plenty. Why doesn't 1Password? I know their engineers are active on this site and provide answers occasionally. So that's why I am asking. I've heard 1Password is security all the way, so I thought they must have "security" reason why they choose to implement things this way.

closed as off-topic by Steffen Ullrich, Teun Vink, Rory Alsop Oct 1 '18 at 8:27

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    You are essentially asking us to explain why a specific commercial product is missing some feature. This is not the support site for this product. Even though you expect engineers from the company to hunt forums this is not the right place to ask - instead contact the company directly using their support. – Steffen Ullrich Oct 1 '18 at 5:08
  • If the question is slated to be removed - please let me know, I'm happy to remove my answer if it makes things easier to remove an off-topic question. – HomoTechsual Oct 1 '18 at 9:11
  • It turns out the issue wasn't security. I changed the title. What about now? – user4951 Oct 1 '18 at 17:38
  • Actually there is a question here that says that 1 password doesn't support 2FA. I forget – Sharen Eayrs Oct 4 '18 at 20:33

So to start with, your question is based on a false premise, namely that you can protect your 1Password account using 2FA (Two-factor Authentication) from the 1Password website.

You can use any TOTP compliant app or a Yubikey device.

1Password can itself be used to generate TOTP codes but it ABSOLUTELY SHOULD NOT be used to generate TOTP codes for itself (for reasons which should be obvious!)

Enabling 2FA with 1Password requires a 1Password membership.

Source: https://support.1password.com/two-factor-authentication/

  • Wow. 3 factor authentication. Good. Very good. – Sharen Eayrs Oct 1 '18 at 9:22
  • 1
    I'm not seeing a third factor. Things you know: Secret Key, Email, Password Things you have: 2FA token/device – HomoTechsual Oct 1 '18 at 9:22
  • 4 factor. password, secret key, email, 2FA. That'll calm the fear – Sharen Eayrs Oct 1 '18 at 9:31
  • 1
    No, still 2Factor... en.wikipedia.org/wiki/Multi-factor_authentication Generally when we describe something as NFactor we're talking about the number of factor groups in use. Not the number of individual factors. So we can get upto 3 factors (Knowledge something you know, Possession something you have, Inherence something you are) For Example: PIN Number, Bank Card, Fingerprint – HomoTechsual Oct 1 '18 at 9:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.