Nevertheless I chose my Yubikey instead.

  • hswolf@lemmy.world
    link
    fedilink
    English
    arrow-up
    20
    ·
    11 months ago

    If you get Bitwarden pro (really cheap), you can save an OTP link together with the site credentials, it’s really good for keeping everything in one place

      • kniescherz@feddit.de
        link
        fedilink
        English
        arrow-up
        15
        ·
        11 months ago

        I would argue its more like a 1.5 factor. Not secure when your bitwarden gets compromised. But more security for stolen, leaked, phised passwords.

        I currently have 60 OTPs in Bitwarden, I probably would not have activated 2FA on so many sites without BW.

      • hswolf@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        11 months ago

        yeah, while I understand that, it’s not every time I have both my phone and computer together at the same time

        using a standalone OTP on either one of them would make the opposite a pain in the ass to use

        I take a lot of precautions with my main vault password, even got a biometric reader so I don’t have to type the password that much

        • PracticalParrot@discuss.tchncs.de
          link
          fedilink
          English
          arrow-up
          2
          ·
          11 months ago

          You’re absolutely right. It’s all about your threat model, how much convenience you’re willing to lose and what not.
          I absolutely should do more to minimize potential risk, but it’s really so convenient to just… Have it all in 1 place…

            • PracticalParrot@discuss.tchncs.de
              link
              fedilink
              English
              arrow-up
              2
              ·
              11 months ago

              This is a smart solution. Only solution I have so far is self hosting bitwarden, using unique password to login, and having 2fa to login to bitwarden, where the key is in bitwarden, and on aegis on a phone at home.

    • IdleSheep@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      24
      ·
      edit-2
      11 months ago

      This isn’t really a good idea because then you’re putting all your eggs in one basket. The whole point of 2FA is that the second factor is in a separate location so if your first factor (password) gets compromised the second one (OTP code) still protects your account. If both factors are in one place you’re back to a single point of failure instead of 2, losing a key benefit of 2FA.

      If you’re gonna do this, at the very least have 2FA with a security key on your bitwarden vault.

      • kniescherz@feddit.de
        link
        fedilink
        English
        arrow-up
        4
        ·
        11 months ago

        You lose security, sure. But you are gaining so much more ease of use. Bitwarden autofills your credentials and puts your token into your clipboard. Also it syncs your tokens to all devices. Effectifly this makes a site as easy to login as a site without 2fa.

        The alternative is on desktop always get your smartphone, open some app type a token or on the phone to switch to multiple apps to get your credentials. Not fun imho.

        I currently activated 2fa on over 60 sites, I doubt I would use it as much without BW.

        For me, the key benefit of 2Fa is getting more security against leaked, stolen, phished passwords, and that still holds up.

        • IdleSheep@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          3
          ·
          edit-2
          11 months ago

          The alternative is on desktop always get your smartphone, open some app type a token or on the phone to switch to multiple apps to get your credentials. Not fun imho.

          There are desktop apps for OTP, you don’t need a phone. And since you only need to setup an OTP secret once, doing it for your phone and pc isn’t that big of a deal.

          I have my OTP secrets in 3 places, 2 yubikeys and my phone’s authenticator app, with the former meant for my PC.

          For me, the key benefit of 2Fa is getting more security against leaked, stolen, phished passwords, and that still holds up.

          If your vault doesn’t have 2FA too this doesn’t hold up though. Means you’re trusting a single service that can get hacked with all your secrets. Sure, your other accounts are more protected against leaks and stuff, but if your password vault isn’t, you didn’t really change much, just pointed the hackers to one single place.

          Yes I know hacking a password vault isn’t some walk in the park and rarely happens, but the point is any leaks from it would be 10 times more catastrophic for you if all your OTP secrets are also stored in it. I’ll spare myself from that nightmare with the small inconvenience that is a separate, offline OTP app.

    • derpgon@programming.dev
      link
      fedilink
      English
      arrow-up
      4
      ·
      11 months ago

      If you get Vaultwarden, absolutely free, you don’t have to pay and have full control over your data. It’s a win-win!