Hide TOTP secret key when unlocked
Hi,
Wondering if there is a way to hide my totp secret key or at least allow an extra step so if I want to see the key I need to type in my master password.
I have Authy and noticed that you cannot see your keys at all which is a nice security feature.
This is so that if I walk away from my unlocked vault (within the timeout period) someone will have access to both my passwords and secret key’s.
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Comments
-
This falls into the realm of double verification, which has been addressed here before (but is admittedly very hard to find). In short, if you're looking to protect yourself against an attacker who may gain physical access to your device, the best thing that you can do is keep 1Password locked. If you think you may step away without locking it yourself, setting up auto-lock would be the solution.
An attacker with access to your unlocked 1Password application would be able to do any number of harmful things, and keeping your TOTPs behind an additional prompt would be unlikely to prevent a sufficiently powerful attacker from getting what they want. This also applies to your unlocked device in general, with which an attacker may be able to install malware or a malicious copy of 1Password to trick you into disclosing your credentials. With that in mind, I'd also recommend setting up auto-lock on your device itself.
Last, I should say that keeping your operating system and web browser up to date should prevent issues with any sort of malware. With these three things in mind (locking 1Password, locking your device, keeping everything up to date), you should be able to avoid the risks associated with an attacker with physical access to one of your devices.
0
