Getting started with 1Password for your growing team, or refining your setup? Our Secured Success quickstart guide is for you.
Forum Discussion
HNofX82
2 years agoDedicated Contributor
Best Way to use 1Password along with other security mechanisms ?
Hello,
Fairly new to 1Password.
1Password itself is very strong for security passwords... but using same alongwith other security mechanisms (available for free) makes it more tighter, which i...
Former Member
2 years agoThe mechanisms you listed implement different concepts and serve different purposes. You also omit the most widespread and basic mechanism: username/password.
If it comes to SMS, which you seem to prefer: don't rely on it. It's insecure, especially for financial transactions. Try to migrate to some other mechanism, if the financial provider provides it. The more recent a mechanism was offered by some provider, the more secure it is in general. Change to the more recently offered mechanism. (security goes forward, not backwards in time)
SMS is not very secure, because there are real world scenarios (it happened!) where criminals ask the telco provider to send them on your behalf a "replacement" sim to their site, so they're able to receive the SMS. The SMS protocol itself isn't encrypted as well, so it's possible to siphon SMS communication from the internal telco equipment.
Login with Google/MS/FB is mostly for convenience. You have only 1 account and use its credentials elsewhere. It's as secure as your Google/MS/FB account. Google/MS/FB care for account security, so these are accounts with somewhat strong security, often better than the security of the service you're logging in if you don't use Google/MS/FB. The only downside is that you're dependent on an additional service for authentication: Google/MS/FB. If you lose your Google/MS/FB account, you lose every other account you use your Google/MS/FB account to login to. It lessens management, because instead of managing your whatever account, you only need to manage your Google/MS/FB account. Personally, I hate the dependency, so I never use "Login with Google/MS/FB". But that's only my personal preference. I don't know if using Google/MS/FB will provide better or worse security.
TOTP codes stored within 1Password: As far as I remember, studies have shown that the directive to use a separate authenticator app on your mobile is inconvenient for many users in a way that many users don't actually enable 2fa on their accounts to avoid this inconvenience. So they operate their accounts on less security for convenience. It was agreed that it's better to include TOTP generation into password managers (where the other factor is already stored: the password) to provide the missing convenience instead of letting users avoid TOTP completely. Studies have also shown that storing both factors in the same password managers don't actually reduce security much, because compromising this would require a successful attack on the password manager on a client, not only mass hacking website user databases.
So storing your TOTP codes in 1Password helps convenience and don't actually reduce security much. And actually, since I use that feature in 1Password myself, I actively strive to enable 2fa with TOTP on every account I own instead of reluctantly enable it if the website insists on it as in previous time, where I used a standalone authenticator app on my mobile.