How does AgileBits verify the identity of a user when disabling two-factor authentication?
When researching 1Password's 2FA implementation, I learned that AgileBits support members are capable of disabling 2FA on an account to help a locked out user (even on an individual account).
I understand that our data remains end-to-end encrypted. An attacker would have to surreptitiously break into my safety deposit box and steal my Emergency Kit first, which probably means I have larger problems. It's much more likely that I lose my 2FA device and any backups.
But it's a little troubling to know that you possess this ability. 1Password markets itself as having a strong "zero knowledge" security model, which is why I trust it. This feature does not feel like it fits that model, and erodes that trust a little, as it makes me wonder if there are other areas where security has taken a backseat to user-friendliness.
So how does AgileBits verify my identity if I request disabling 2FA?
1Password Version: 7.2.4
Extension Version: Not Provided
OS Version: macOS 10.14
Sync Type: 1Password.com
Comments
-
(In hindsight this should probably be filed under "Topic > Memberships")
0 -
- Moved to memberships
0 -
Thanks @thightower. :)
@quickbyte Our security team will review your account and ask questions that only someone who has had access to the account would know the answers to, such as billing details, timelines, and other such details. This communication must happen via a verified email address, which means in addition to needing your Secret Key and Master Password an attacker would also need to be able to receive email at your address.
Ben
0
