> Strong support for the strategy of not putting your TOTP/MFA in your password manager

Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place.

Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device.

A password manager + built-in TOTP on a dedicated device is fine for most general usage. Important TOTPs can go to Yubikeys.

On Linux, would something like Snap or Flatpak have protected them? It seems nuts that a random executable should have access to the password service.

At the very least, a different account for your password manager at work, hopefully paid by the company, which you don't install outside of company-controlled devices.

You can make it so you need a YubiKey to login to 1Password the first time on a new device

So just waiting for the password won’t be enough

I think this is true in technical terms, but I have not seen a compelling description of what that looks like without it sounding like a real pain to manage.

Does anyone have a description of something manageable?

Wonder if you could run your password manager in an isolated sandbox that couldn’t provide the secret behind the TOTP, only the current value.

> putting your TOTP/MFA in your password manager

I suppose the inverse would be starting with a device that offers TOTP/MFA, and then making your password-manager/vault somehow available on that same device. In either case, bringing them together makes it easier for an attacker to compromise both at the same time.

On reflection, I've never actually put my (personal) password vault on my phone, but that may be less of a conscious security stance than fulfilling a millennial stereotype, where certain tasks (like big purchases) are reserved for "a real computer."

Closest I've gotten is having my USB backup keychain in the same pocket, so I could get to it in an emergency, but it's inconveniently air-gapped.

i would also offer, do not use the same device for everything, make sure any local connectivity has firewalled [dot]finances, and [dot]tech lab from each other and else. you should probably split your network to further isolate.

use intentional spelling mistakes in your password vault, edit the password by hand. you also need to have some way of authenticating login components to be sure your running your version of login, and not a trojan login.

Separate and additional auth service based on physical ownership is always nice!

Or using a hardware authenticator.

Story states he wasn't using 2FA for his 1password account at all.