two factor authentication on shared vault accounts

Hi there @73Bruin

I'll come to each point separately for clarity.

Is there a practical way (when a website supports) two factor authentication (other than by SMS message) to have this setup for accounts in a shared vault.

Yes. There's no difference between two-factor authentication on an item in your Private vault or in a shared vault – 1Password treats them all the same. So if you set up two-factor authentication for an item in your shared vault (using 1Password as the authenticator), it'll work for everyone who is allowed to see that item.

BofA supports USB Security Keys that support FIDO. Conceptually, can we each have two or more USB keys (e.g. a Yubikey 5c Nano for our laptops and a Yubikey 5c NFC for our cell phones and other devices) that all provide TFA for this account?

It depends, and to be honest, that's a question the bank will be able to answer more authoritatively than us. They might only allow one security key, or have some limit. If you're using hardware keys for two-factor authentication, 1Password won't be involved, so have a chat with the bank to find out more about that.

Conversely, we both have separate accounts to various medical websites (e.g. doctor's office, pharmacy etc). These separate accounts are in separate shared vaults that we again both have access to (for emergency's, billing etc). Do USB Security keys support duplicate sites for separate accounts?

Again, there might be limits imposed on this by the website in question. You might not be able to use the same security key for multiple accounts with the same website.

1Password supports TOTP (time-based one-time password) for two-factor authentication on your items. Using a hardware security key bypasses 1Password completely since the website communicates directly with the key, so we have no input in the process.

Is there a practical limit on how many websites or other places we can use TFA on?

All of them! Wherever you can use two-factor authentication, you should. Watchtower in 1Password will tell you if you're not using two-factor authentication on websites it knows supports it.

Finally, is there a downside to this strategy of using TFA on shared accounts?

Doesn't sound like it to me. The only thing I would be wary of is recovery options. If you're using only a hardware security key for two-factor authentication at a website, look into what happens if you lose that key or it stops working. If you can set up an authenticator app as well, 1Password can be that authenticator: Use 1Password as an authenticator for sites with two-factor authentication.

Please let me know if you have any questions, or would like any further help. :)

— Grey