I'm looking into using 1Password, and I like the trial a lot. However, I'm missing a functionality of using a paper-based 2fa, like Grid that LastPass has. If I use 2fa and my phone breaks, I could get locked out of my account like this. If I could also add a paper based 2fa, I could keep the printed paper safe somewhere in case I need it.
Do you know if such a functionality is available, or in development?
Posted Oct 4, 2021, 9:42 AM UTC
I keep a local record of the 2FA manual entry code, so I can always set-up another authenticator app.
1Password only asks for 2FA once per device/app and allows you to disable 2FA from any previously authorized app.
This is good information. Where do I find the 2fa manual entry code?
When you're on the page where you set-up your authenticator app there's a 16 digit manual entry secret next to the QR code. See the small note in the following instructions:
Thanks.
This is essentially the same as backing up the QR code on its own :-). Both the manual code and the QR code provide the same info, but the manual code is readable without an MFA app so it’s a little bit easier to handle.
Keep in mind that, as mentioned in the guide for setting up two-factor authentication, you can actually disable it from any already-authenticated device on which you use 1Password. Plus, if you use 1Password with other people, like in the case of 1Password Families, going through recovery would also give you a reset as far as two-factor authentication goes. In order to truly lock yourself out, you'd need to be using 1Password by yourself, on a single device, and then lose your codes.
At that point, you can write into [email protected], and someone (probably me) will put you through a round of verification questions to help you disable two-factor authentication. Unlike your 1Password account password and Secret Key, two-factor authentication is not used for encryption purposes, and so it can be disabled on our end.
You could print the QR code and store it in a safe.
Bu the QR code isn’t enough if you have 2fa turned on, right?
You can just scan the code again when you want to setup MFA for a new phone.
Really? That’s neat.
This is what you need to recover your account:
You can use that QR code with any TOTP compatible authentication app, like Google Authenticator, Authy, etc. you can scan it as often as you like on any number of devices, and they will all give you the same codes.
Thanks. I get it now. The emergency kit is basically enough to get access even if you lost the 2fa phone.
The emergency kit alone is not enough if you have turned on 2FA. You need the 2FA code too, which is a separate QR code.