3 ms·
The specific mention of Bitwarden made it sound like there's something wrong with Bitwarden's implementation of TOTP in particular (which would be hard, since t
by apetresc 4y ago
The specific mention of Bitwarden made it sound like there's something wrong with Bitwarden's implementation of TOTP in particular (which would be hard, since the TOTP client doesn't really do much beyond store a very password-like string).
But it's not; the author's point is just that putting your MFA token into the same place as your other passwords defeats some of the purpose of "multi-factor" authentication in the first place, since a breach of your password manager gets the attacker both factors.
So, nothing in particular for Bitwarden users to worry about, just general OpSec advice.
- AtNightWeCode 4y agoYes. But where to store the backup codes for occasions when that device breaks or get stolen. That is what I like to know. Cause several providers says in a pw manager.
- g_p 4y agoThis seems like a use case for an offline password manager (which will no doubt still run on the same device, and therefore offer limited benefit), or doing something like gpg encrypting the information to your own gpg key (and storing that key offline or on a yubikey, and not putting the gpg private key on the computer with access to your password manager).