4 ms·

It seems like the alternative is to allow anyone with just the master password to get access to your vault. That doesn't seem so great. I'm on 1Password and it

It seems like the alternative is to allow anyone with just the master password to get access to your vault. That doesn't seem so great. I'm on 1Password and it's basically a 2FA setup there too: to register a device, you need to have the master password (what you know) and the secret key (what you have, randomly generated at vault creation). Losing my phone isn't a big deal because I have 1Password on multiple devices, each with a copy of the secret key, so there's pretty good hedging there. I also carry a physical Yubikey, which grants me passwordless access to my email account (assuming I know the PIN to unlock the hardware, which I do). That's probably overkill for most people, but that's another layer of hedging too.

mvdtnz 2y ago
> It seems like the alternative is to allow anyone with just the master password to get access to your vault. That doesn't seem so great. Given that only I have my master password I don't see what's wrong with it.
- hypeatei 2y ago
  What if, for example, a piece of software is logging your key presses without your knowledge? You could have the best, most secure password but you're typing it into a complex machine which could be doing any number of things. Don't forget that you're human and make mistakes too so it doesn't necessarily have to be malicious; a bad copy paste into a public forum post could hose you. A second factor makes it extremely unlikely that one slip up results in a complete compromise of your vault.
  - the_snooze 2y ago
    You don't even need a keylogger for password leakage. You could accidentally type in your password into a logged field because you forgot to press tab or alt-tab to move cursor focus. 2FA for setup doesn't strike me as too onerous. It only happens once per device, after which you're free to rely on just your master password or even biometrics.
  - fwn 2y ago
    > What if, for example, a piece of software is logging your key presses... Even easier: What if someone beats you with a stick until you unlock your password manager? Security is always a compromise around a lot of assumptions about threat model, usability, etc. Nudges are a great way to increase overall user security with almost no drawbacks, but ofc ultimately things like this always have to be user choice.
  - JambalayaJimbo 2y ago
    I think what you're forgetting is that Bitwarden only has access to my passwords, not any account (that does any important work) itself. All my high security accounts themselves are protected by 2FA and in some cases 2+ factors (such as my bank). 2FA on a password manager is useless. I'm going to end up entering phone codes multiple times for a single login and that will drive me away from using the password manager.
  - TheFreim 2y ago
    If there is software that is logging my keys it can also likely steal my cookies, in which case they don't even need any of my passwords or 2FA codes.
patrakov 2y ago
It's, possibly, not good enough. In case of a fire, if you left all your phones at home, you are screwed. Exactly because of the fire risk, I set a policy for myself that all passwords should be somehow recoverable only from something that I know. However, I don't meet this policy at the moment.

mvdtnz 2y ago

> It seems like the alternative is to allow anyone with just the master password to get access to your vault. That doesn't seem so great. Given that only I have my master password I don't see what's wrong with it.

hypeatei 2y ago
What if, for example, a piece of software is logging your key presses without your knowledge? You could have the best, most secure password but you're typing it into a complex machine which could be doing any number of things. Don't forget that you're human and make mistakes too so it doesn't necessarily have to be malicious; a bad copy paste into a public forum post could hose you. A second factor makes it extremely unlikely that one slip up results in a complete compromise of your vault.
- the_snooze 2y ago
  You don't even need a keylogger for password leakage. You could accidentally type in your password into a logged field because you forgot to press tab or alt-tab to move cursor focus. 2FA for setup doesn't strike me as too onerous. It only happens once per device, after which you're free to rely on just your master password or even biometrics.
- fwn 2y ago
  > What if, for example, a piece of software is logging your key presses... Even easier: What if someone beats you with a stick until you unlock your password manager? Security is always a compromise around a lot of assumptions about threat model, usability, etc. Nudges are a great way to increase overall user security with almost no drawbacks, but ofc ultimately things like this always have to be user choice.
- JambalayaJimbo 2y ago
  I think what you're forgetting is that Bitwarden only has access to my passwords, not any account (that does any important work) itself. All my high security accounts themselves are protected by 2FA and in some cases 2+ factors (such as my bank). 2FA on a password manager is useless. I'm going to end up entering phone codes multiple times for a single login and that will drive me away from using the password manager.
- TheFreim 2y ago
  If there is software that is logging my keys it can also likely steal my cookies, in which case they don't even need any of my passwords or 2FA codes.

patrakov 2y ago

It's, possibly, not good enough. In case of a fire, if you left all your phones at home, you are screwed. Exactly because of the fire risk, I set a policy for myself that all passwords should be somehow recoverable only from something that I know. However, I don't meet this policy at the moment.