Forum Discussion

Anonymous's avatar
Anonymous
4 years ago

2FA - General question

I am a new 1Password user and so far very satisfied. However, I have one question. Do I understand correctly that I only have to enter the 2FA code once per device? But I would like to use a 2F...
windows
AliH1P's avatar
AliH1P
Icon for 1Password Team rank1Password Team
4 years ago

Hey @twisternet, thanks for your question!

As Former Member explained, requesting 2FA every time you log onto your PC would not actually increase the security of your account.

Let's take a step back to a higher-level view. 1Password uses a couple key ingredients to protect your data:

  1. Your account password - this is the one you type in to unlock the app. It protects you against attackers who might gain access to your device. If they don't have the password and can't crack it, they can't get in. This is why a strong password is important.

  2. Your Secret Key - this protects you against attackers elsewhere. For example, if someone tried to access your 1Password.com account and used some kind of automated password-guessing software against our servers, it actually wouldn't matter if they successfully guessed your password. That's because we only unlock your data when your password is combined with your Secret Key, and guessing the combination of these things together is incredibly difficult to do. About your Secret Key.

With that in mind, 2FA is used to authorize a device once. After you've successfully authorized a device, there is no added security in asking for 2FA every time you log in - the data is already stored locally on the device alongside your Secret Key, so from a security perspective, it doesn't make much sense to ask for 2FA on every login aside for making things more cumbersome for users.

Essentially, 2FA protects against a case where an attacker knows your account password and Secret Key, but doesn't have a copy of your database. They would be unable to access your data on their own device. If an attacker gained illicit entry to an authorized device and had your credentials, then they would have a copy of your database and 2FA would not have any additional benefit.

You may find this article useful if you'd like some further details: Authentication and encryption in the 1Password security model

I hope that helps clarify some things. Let me know if you have any further questions. Thanks!

Ali