4 ms·

This looks great - thank you so much for opening up the server too! About auth, I'm not sure the claim in the readme is entirely correct: > Two years ago, whi

by e12e 3y ago

This looks great - thank you so much for opening up the server too! About auth, I'm not sure the claim in the readme is entirely correct: > Two years ago, while building Ente Photos, we realized that there was no open source end-to-end encrypted authenticator app. Surely bitwarden existed and had 2fa support two years ago? Granted it's not only an authenticator app... Ed:[I guess 2fa is/was a pay-only feature, so only source-available? ] Looks like auth is a great dedicated 2fa app by the way, surprised I've not come across it before.

vishnumohandas 3y ago
The primary issue with Bitwarden is that your passwords and 2FA tokens are stored at the same place, essentially nullifying the second factor. Also, the feature to store 2FA tokens is only available on Bitwarden's paid plan, while with Ente it's free.
- amarshall 3y ago
  > essentially nullifying the second factor Not totally. It still protects from the password being disclosed via other means (e.g. server db leak).
  - e12e 3y ago
    Well, no - if we assume server password db leak includes leaking totp shared secret... But that is also why I'm not overly concerned by the bitwarden model: in client compromise (ie phone), attacker gets both password and totp secret. But so too in many examples of server compromise. Seperate totp app doesn't really mitigate any risk factors - but a seperate hw token/device do. You could have 2fa only on phone, password manager only on desktop - but then logging in anywhere on your phone is inconvenient. Then again: "Security is not a convenience".