In a sim swap attack, they don't steal your phone, they use their own phone and steal your text messages to get the authentication code. TOTP is more secure than an SMS text based authentication method. Which is what they'd have to do to get that Google sign in prompt. In a sim swap attack, the attacker doesn't steal your physical phone. But I think you're misunderstanding the attack vector. My understanding is that TOTP is a more secure 2FA method because of the potential for a SIM swap attack compromising a phone. Why do you want to use 1 Password TOTP over your phone as a sign in prompt? I find the phone prompt more convenient. Unfortunately, I'm at a dead end at this point. However, I would rather use 1Password as I already subscribe to that, though I understand many people favor a passkey as more secure. The thread went on to discuss that using a passkey it is possible to substitute that for a mobile 2FA more easily. However, I was unable to completely turn off 2FA. Searching for a solution online, I found a reddit thread where a person reported success by completely turning on 2FA authentication, then setting it back up without a mobile device. I tried to remove having my mobile device as the 2FA method, but I could not.

So that defeated the purpose of my setting up the 2FA with 1Password authenticator. Once I verified, I was in to the account. Google then sent a 2FA prompt to my mobile phone. But I wouldn't recommend doing that unless you enjoy the pain. If you're super duper paranoid, I believe there is a Google security account setting somewhere that will force you to enter the TOTP code for any device. This retains and saves no cookies, so it will ask you for any TOTP code every time. To test it, you can also open a browser window on a computer in 'incognito mode'. If you instead got a brand new device and tried logging in to Google, it would ask you for your TOTP code from 1password. It retains this cookie for a certain number of days/weeks (or in the case of a phone, possibly until you wipe it). What is happening is when you login to Google, it's saving a cookie on each device that has previously logged into your google account before. This is true even on a device where I do not have 1Password installed. It does not ask for a code from my authenticator app. When I sign out of Google on any device and sign in, it still just asks for my password. Oddly, this seems to have had no effect on my sign in process for Google. Google confirmed and now my security settings indicate that authenticator is added as a sign in. In the set up process, Google generated a QR code which was scanned by 1Password which generated a one time code which I then entered into Google. It seemed to me that I could use 1Password as my authenticator app and I set this up in my Google security settings. Google’s Titan also can be used with iPhone and iPad over a Bluetooth connection.Thanks to this forum I adopted 1Password as my password manager.įor added security against a SIM swap attack I would like to use something other than my phone for 2 factor authentication (2FA). While Yubico’s new security key is the first to add a Lightning connector, it’s not the first compatible with iOS devices. And for those looking for the right software, Dashlane is the official password manager of Cult of Mac. The YubiKey 5Ci went on sale today for $70. If you use the Brave iOS browser on iPhone or iPad, it can access, ,, and .įor USB-C devices, Yubico’s offering supports with FIDO2/WebAuthn, FIDO U2F, OTP (one-time password), PIV (Smart Card) and OpenPGP. You can use the YubiKey security key to secure Dashlane, 1Password, Bitwarden, Idaptive, LastPass and Okta iOS apps. “In an increasingly mobile-first world, where users are not tied to one machine, the YubiKey 5Ci serves an important role as a portable root of trust, proving that users are who they say they are, no matter what device they are on,” said Jerrod Chong, Yubico’s chief solutions officer. At present, it’s not yet fully compatible with iPad Pro models with USB-C ports, however. They prevent accounts from being used unless the physical key is available, even with a password.īecause the YubiKey 5Ci has both Lightning and USB-C connectors, it can be used across iOS, macOS, Android and Windows computers. Security keys enable two-factor hardware authentication for accessing online accounts.

Yubikey for 1password