2 ms·
Just use Bitwarden. The UI is clunkier, but the UX is better. After it fills in the username and password, it puts the OTP in the clipboard, so you can just pas
by lern_too_spel 3y ago
Just use Bitwarden. The UI is clunkier, but the UX is better. After it fills in the username and password, it puts the OTP in the clipboard, so you can just paste and go without opening an app and manually copying it into the login form.
- tremarley 3y agoUsing a password manager as your authenticator seems very risky to me. You should use separate services. If your password manager is breached, at least the infiltrator cannot pass 2FA.
- lern_too_spel 3y agoIt is no different from Passkeys in that regard, yet we're fine with that. If you want extra security, you would have your password manager and your OTP generator on different devices, but only a small fraction of people do that. Storing your OTP generator secrets and your passwords in the same app provides a reasonable trade-off between security and convenience for most people.
- patrakov 3y agoLet me add: for services like GitHub that never log you out, 2FA is pure security theater. The only factor in this case is a browser cookie.
- belthesar 3y agoI'm hard opposed to storing my second factor codes alongside my first factors. Part of the reason why I use 2FA is because if my password store is compromised, the accounts in it that are compromised do not contain all of the credentials necessary to log into the accounts protected by 2FA. I also do not store my emergency removal codes in the same secret store as my passwords for this reason.