Hacker News new | ask | show | jobs
by akerl_ 2609 days ago
Storing your 1Password Master Password on a yubikey seems like a really bad idea for most threat models. This means that anybody in physical possession of the Yubikey can immediately and permanently steal your master password. Additionally, for shared computers, anyone who can run code on that system can log static creds, the same as if the user typed it.
3 comments

You can store your 1Password master password (or any other static password) on your yubikey with a few of the last characters missing. You'll plug the yubikey in, press the button and manually type the missing characters to complete the password. This way if you lose it, however finds it has an incomplete password and no idea where it belongs to.
They're not storing the Master Password on the yubikey, they're storing the secret key, which are two separate things both required to log onto 1password, but the secret key is completely randomly generated.
Agreed! I don't use that feature at all for the same reason. I don't have my key with me at all times.