1Password, Yubikey and Yubico Authenticator

guillaumeserton

Hi All,

I'm thinking of buying Yubikeys.
Today, I'm using 1Password Families and Teams on mac and Android mainly. Rarely the web version
I'm keeping all my credentials in 1password. For website with MFA, I enabled them with TOTP when it's available, so my TOTP are stored in 1P too.

I haven't already read enought on Yubikey, but I'm wondering what I could achieve in my current workflow if I'm buying Yubikey to add with 1password.

Do I need to replace 1password app by the Yubico Authenticator, what I will not be able to achieve if I'm not using this Yubico Authenticator app and I keep 1password (that I will prefer).

Thanks for your help.

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

guillaumeserton

Hi,

is there anyone using Yubikey and also 1password app?

Ben

Hi @guillaumeserton

The difference between having a Yubikey do your TOTP vs having 1Password do it is that you would need your Yubikey in order to generate TOTP codes, instead of needing a device you've authorized 1Password on + your Master Password. Which would be more convenient is up to you, but i use 1Password. :)

Ben

guillaumeserton

Thanks @ben
That was my thoughts.
Yubikey seems more secure to me because it's hardware but pain in the #ss on usability.
However I think I'm going to try.

ag_ana

Sounds good @guillaumeserton, let us know how it goes :+1: :)

guillaumeserton

It goes very well :)
I have registered my 2FA TOTP on my two Yubikey (using Yubico Authenticator) then register my both Yubikey as well for the U2F.

All seems working fine.
Now my Family account and my business account are more secured.

Just I don't understand why we cannot disabled the TOTP. I would prefer to get a backup code instead. Maybe it's because U2F is not yet supported by all apps.

Ben

That's exactly it. :)

Ben

prime

Maybe it's because U2F is not yet supported by all apps.

@Ben ...... when? I’m dying for this :lol:

ag_ana

@prime:

We are working on it, but unfortunately we don't have an ETA to share yet, sorry!

Malbec

I generally like the convenience of having TOTPs generated in 1Password for the websites. However wouldn't be it beneficial of having something like Yubico Authenticator to generate TOTP for 1Password online account only? Let's assume we are going to log in from unauthorized device without having any of the 1PW authorized devices next to us. Then having 1Password doing TOTP for 1Password account we won't be able to access the data.

guillaumeserton

@Malbec
That's my workflow today. My 1P TOTP is on my Yubico. Not only 1password but other website too. For some I keep the TOTP generated by 1P, but for my "high sensitivity" accounts, I put them on my Yubikey.

Ben

@Malbec

I'm not entirely sure I understand what you're saying, but if I follow... We don't recommend having 1Password be the only place you store your TOTP secret for your 1Password account. We recommend also using Authy, Google Authenticator, or similar. Yubico Authenticator could work too. :)

Ben

Malbec

@guillaumeserton Thanks for sharing your work flow. Make sense to not put all TOTP codes in one basket.

@Ben yes, exactly this was my question. Keeping TOTP for 1Password online account with 1Password only could become problematic should we find ourself in a situation without authorized devices. Correct me if I am wrong but it is possible for 1Password staff to disable 2FA on the account after some verification.

Also the emergency kit doesn't store any info about 2FA such as QR or secret code. So this should be added by the user himself to such kit, right? Because as I understand in order to use "authenticator apps" they would need to scan exactly the same code, is that right?

Ben

Correct on all counts. :+1:

Ben