5 ms·

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independ

by lxgr 2y ago

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.

Uvix 2y ago
Yes, Bitwarden can store both.
- lxgr 2y ago
  I was referring to Firefox with that question.
  - odo1242 2y ago
    It can't, you need a browser extension for that.
  - Uvix 2y ago
    Ah, sorry for misunderstanding.
freedomben 2y ago
There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis on Android, or Gnome Authenticator on desktop (or both). I like to duplicate/backup my seeds so that I'm not SOL if my phone breaks, but I do it by having them on my laptop, desktop, and phone. That way as long as I have one of the three devices, I can always get in, and then they're not "in the cloud." Though, "in the cloud" is still better than "in the cloud alongside all my passwords."
- magackame 2y ago
  Doesen't having the seeds available on all of the devices make it not 2FA? You now need only one device to login at any given time.
  - mason55 2y ago
    The second factor isn’t a second device, it’s the TOTP code.
    - AStonesThrow 2y ago
      No, factors are supposed to have different qualities, such as: "Something you know"; "something you have"; "something you do"; "something you are [biometrics]"; "somewhere you are [geolocation]". Passwords are in your head - "something you know". TOTP codes are generated by a hardware token - "something you have". If the TOTP codes are crammed into your password manager, then the factors are no longer distinguished by these qualities, but they're now the same factor, and it's not true MFA anymore, whether or not they're split up across devices, or apps.
      - akho 2y ago
        2FA via TOTP implies two things: 1) you know a password; 2) you know the seed. This is why people criticize that approach. In practice, knowing a password and having a file (seed) seem different enough, and work against some phishing threats. Logging in through a password manager requires that you know a password (your master password), and have a file (your vault).
        KPGv2 2y ago
        Or alternatively something you are (fingerprint) alongside something you have.
      - ivanfilhoz 2y ago
        Actually, they are pretty much split up. To get access to my passwords and TOTP secrets, the attacker needs one of my devices (something I have) and its password (something I know) or my face/fingerprint (something I am). The whole point of a fully featured password manager like 1Password or Bitwarden is to rely on it instead of the security of the service you're using. And that implies that you must trust the security of the vault itself. Of course, each device you have is an additional (an equally dangerous) attack surface. However, most people should be more worried if someone hacks into their devices than their Facebook accounts anyway.
odo1242 2y ago
Yes, through TOTPs will run you a (worth it imo) $10/year subscription. Passkeys have been supported for a while (free) on all major platforms, and I haven't seen any issues with it.

by lxgr 2y ago

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.

Uvix 2y ago

Yes, Bitwarden can store both.

lxgr 2y ago
I was referring to Firefox with that question.
- odo1242 2y ago
  It can't, you need a browser extension for that.
- Uvix 2y ago
  Ah, sorry for misunderstanding.

freedomben 2y ago

There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis on Android, or Gnome Authenticator on desktop (or both). I like to duplicate/backup my seeds so that I'm not SOL if my phone breaks, but I do it by having them on my laptop, desktop, and phone. That way as long as I have one of the three devices, I can always get in, and then they're not "in the cloud." Though, "in the cloud" is still better than "in the cloud alongside all my passwords."

magackame 2y ago
Doesen't having the seeds available on all of the devices make it not 2FA? You now need only one device to login at any given time.
- mason55 2y ago
  The second factor isn’t a second device, it’s the TOTP code.
  - AStonesThrow 2y ago
    No, factors are supposed to have different qualities, such as: "Something you know"; "something you have"; "something you do"; "something you are [biometrics]"; "somewhere you are [geolocation]". Passwords are in your head - "something you know". TOTP codes are generated by a hardware token - "something you have". If the TOTP codes are crammed into your password manager, then the factors are no longer distinguished by these qualities, but they're now the same factor, and it's not true MFA anymore, whether or not they're split up across devices, or apps.
    - akho 2y ago
      2FA via TOTP implies two things: 1) you know a password; 2) you know the seed. This is why people criticize that approach. In practice, knowing a password and having a file (seed) seem different enough, and work against some phishing threats. Logging in through a password manager requires that you know a password (your master password), and have a file (your vault).
      - KPGv2 2y ago
        Or alternatively something you are (fingerprint) alongside something you have.
    - ivanfilhoz 2y ago
      Actually, they are pretty much split up. To get access to my passwords and TOTP secrets, the attacker needs one of my devices (something I have) and its password (something I know) or my face/fingerprint (something I am). The whole point of a fully featured password manager like 1Password or Bitwarden is to rely on it instead of the security of the service you're using. And that implies that you must trust the security of the vault itself. Of course, each device you have is an additional (an equally dangerous) attack surface. However, most people should be more worried if someone hacks into their devices than their Facebook accounts anyway.

odo1242 2y ago

Yes, through TOTPs will run you a (worth it imo) $10/year subscription. Passkeys have been supported for a while (free) on all major platforms, and I haven't seen any issues with it.