Is 2fa needed on 1password?

@sl91911:

We don't recommend a specific model, it really comes down to what you need. For example, if you plan to use this on your iPhone or iPad, then you would need a YubiKey 5 NFC, YubiKey 5C NFC, or YubiKey 5Ci, for example.

@sl91911 Yes, you've captured all that correctly. The desktop app doesn't yet support security keys, so you will need the authenticator app to set-up the desktop app on a new PC.
The choice of YubiKey mainly comes down to the physical connection and the protocols it supports. Most websites only support U2F and FIDO2 which are supported by all of the YubiKeys. But if you want to store your TOTP 2FA secrets in your YubiKey using Yubico Authenticator then you'll need something like YubiKey 5 NFC.

Thank you very much for the great reply. Tell me if I understand this correctly? Also, which Yubikey do you recommend?
1. I do not need 2fa every time I open a 1PW session (I understand your reasoning).
2. I only need 2fa when installing 1PW on another device and until then 2fa not needed.
3. I use Win 10 desktop and have iphone. Therefore, for installation of 1PW on another desktop I could use Yubikey and/or authenticator like Authy on iPhone. 1PW 2fa set up will allow setup for both types of authentication and if I loose the key I could use the authenticator on phone or another Yubikey if registered with 1PW during 2fa setup.

@sl91911:

In addition to what roozero wrote, you might also find this documentation page useful:

https://support.1password.com/authentication-encryption/

@sl91911 1Password is different to other password managers because the secret key and secure remote password protocol protect you from a lot of the attacks that 2FA helps prevent. However, it is still useful.
1. Yes. 2FA protects against the case where an attacker knows your master password and secret key, but doesn't have a copy of your 1Password database.
2. If you want to use a hardware security key for 2FA then you will first need to setup an authenticator app because not all platforms support security keys. The authenticator app can act as your backup if you lose your key. Alternatively set-up multiple security keys and store them separately. As a fall-back you can disable 2FA from any previously authorised 1Password app.
3. No. 2FA is only required to authorise download of the 1Password database to a new device. Install the desktop app and the lock state will be synchronised between the desktop app and all instances of the browser extension.