3 ms·
One common 2FA method is TOTP (time-based, one time password). Bitwarden [0] is a password/secrets manager that you can host yourself. It supports TOTP so you c
by andrewzah 5y ago
One common 2FA method is TOTP (time-based, one time password). Bitwarden [0] is a password/secrets manager that you can host yourself. It supports TOTP so you can just use that instead of a separate app like Google Authenticator or Authy. I would not recommend this personally as if you expose your master password for bitwarden, you've also made it possible for the attacker to sign in via 2FA... which normally would require access to your phone or backup keys. But it is more convenient.
Basically, people should be using password managers by this point. I recommend bitwarden because you can host it yourself, it's good for storing other secrets, and it has browser plugins/apps.
[0]: https://bitwarden.com/ https://bitwarden.com/
- browningstreet 5y agoThanks for the explanation. Follow-up question: I downloaded Authy on my phone and my desktop, and the first thing it wants is a phone number. I'm trying to solve for not having a phone -- can Bitwarden's TOTP be used without a phone number being provided? Thanks in advance.
- PufPufPuf 5y agoBitwarden does not require a phone, but it sadly TOTP support is only in the paid version. What I do is keep TOTP in an app called Aegis, which supports backing up the seeds. This way, I can always use the seed file to setup Aegis on a new device.
- andrewzah 5y agoTOTP support is free if you selfhost it, e.g. with Vaultwarden [0]. 0: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden
- awiesenhofer 5y agoTo be fair, the paid version of Bitwarden is only 10$ per YEAR and you get lots of extra features besides TOTP support with that too: https://bitwarden.com/pricing/ https://bitwarden.com/pricing/