[fishtoaster]

This is absolutely perfect for a use case that I've seen a lot: shared test accounts. Eg our app connects to external service X, so we have a staging account set up such that the staging version of our app can operate. But service X values security and requires 2fa on all accounts. This is really annoying, especially if service X is expensive and charges per seat. We don't want to pay for a seat for all of our developers just for our test account, so we share credentials, which is a pain in the ass with required 2fa. A slack-based shared 2fa account would be perfect for this.

I'd be pretty hesitant to use something like this for accounts I consider sensitive, though, because

A. It's too easy to accidentally add the wrong person to slack, and ideally not everyone at the company has access to all accounts anyway, and

B. It's putting more trust into a third party (tfa.one) than I'd be comfortable with, given how new it is.

But again, perfect for our test accounts, and cheap enough that I don't even need to think about it.

[auslegung]

Do you know 1password handles storing mfa codes?

[fishtoaster]

Yep! I use that with my personal 1password. And honestly, that's probably the way we'll go eventually, but right now we're a super tiny startup - setting up a team 1password and getting every new engineer onboarded seems like a hassle. Even if it's only a few hours of work, tfa.one seems like it's a few minutes of work. For non-sensitive accounts (which is the main pain point I have at the moment), a 1-step tool is awesome. :)

[hnzix]

I thought 1password only allows storing MFA codes for pre-determined sites? Eg it doesn't provide a MFA option for microsoftonline.com.

[amichal]

It prompts for some sites (using some .well-known URL protocol?). But I recently learned you can add the "One Time Password" field type to any Login entry manually. I do it all the time for intranet/test sites that need MFA and I have done it with sites that didn't prompt that are shared in our family (home) and team (work) 1Password vaults. The field time lets you scan a QR code or enter the seed key manually

[hnzix]

Huh that's awesome I didn't know it had that feature. Cheers!

[weird-eye-issue]

Bitwarden does this too