4 ms·

> In this initial release, your data will be backed up through the mobile operating system's backup services. Please make sure your device is turned on and conf

> In this initial release, your data will be backed up through the mobile operating system's backup services. Please make sure your device is turned on and configured for backups. Bitwarden Authenticator data is included in the OS backups and will be restored with them. At least it's not defaulting to their own cloud service backend. This has always been my problem with these types of apps. Although, I'm not sure I fully understand the above description. I'm guessing if you have an iPhone with iCloud backup enabled, it means data is backed up to iCloud.

hackmiester 2y ago
Or if you are using "iTunes backups" it will store them in there as well.
stwrzn 2y ago
> New features on the roadmap include import, syncing to Bitwarden accounts, push-based 2FA, and account recovery. When syncing is added it would actually be something to consider.
- lxgr 2y ago
  > [...] syncing to Bitwarden accounts [...] In that case, what would be the advantage over just using Bitwarden's native TOTP support?
fn-mote 2y ago
Are your cloud backups encrypted? Yes, but the key is backed up too. [1] The regular complaints here about iMessage not having good E2EE is a specific exception written into the security policy. Corrections welcome. [1]: https://support.apple.com/guide/security/security-of-icloud-backup-sec2c21e7f49/web https://support.apple.com/guide/security/security-of-icloud-...
- janalsncm 2y ago
  It really depends what your threat model is. If you are concerned about government intervention a TOTP isn’t going to stop them.
- coder543 2y ago
  https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 I think this is the better link. Advanced Data Protection is end to end encrypted, without the key being backed up to Apple’s servers.
  - bramhaag 2y ago
    This of course only helps if ADP is available in your country and you've turned it on.
procaryote 2y ago
Kinda worrying that it doesn't mention anything about how that is secured. Google Authenticator had the fun idea to opt people into unencrypted (beyond whatever regular google drive files have) cloud backup of 2fa secrets, and it's been exploited in the ways you'd expect.
- izacus 2y ago
  Both mobile operating systems use e2e encryption for the backups.
  - Tepix 2y ago
    Not in the UK for icloud
  - stavros 2y ago
    Android doesn't encrypt everything, and the details of what it does and doesn't encrypt are so fiddly that I don't feel confident enough to enable cloud backups.
    - izacus 2y ago
      Android encrypts its whole backup with E2E encryption using your PIN.
      - stavros 2y ago
        It doesn't, it encrypt some of your backup, and isn't entirely clear on which part.
  - sneak 2y ago
    No, iOS backups are not e2ee unless you go and opt-in to it, which approximately 0% have done.
wongarsu 2y ago
On my Android, what's the upside of using this instead of Google Authenticator if they both back up to the same place? If they used their own cloud backend I would be a lot more interested. They could even offer to store it in their cloud end-to-end encrypted (making it my responsibility to keep the password safe). That would give me similar exposure as their password manager, which I'm already using.
- TingPing 2y ago
  Authenticators are a commodity at this point. None are special.
  - eviks 2y ago
    This just ignores important details like multi device sync, which to few support for being "commodities"

hackmiester 2y ago

Or if you are using "iTunes backups" it will store them in there as well.

stwrzn 2y ago

> New features on the roadmap include import, syncing to Bitwarden accounts, push-based 2FA, and account recovery. When syncing is added it would actually be something to consider.

lxgr 2y ago
> [...] syncing to Bitwarden accounts [...] In that case, what would be the advantage over just using Bitwarden's native TOTP support?

fn-mote 2y ago

Are your cloud backups encrypted? Yes, but the key is backed up too. [1] The regular complaints here about iMessage not having good E2EE is a specific exception written into the security policy. Corrections welcome. [1]: https://support.apple.com/guide/security/security-of-icloud-backup-sec2c21e7f49/web https://support.apple.com/guide/security/security-of-icloud-...

janalsncm 2y ago
It really depends what your threat model is. If you are concerned about government intervention a TOTP isn’t going to stop them.
coder543 2y ago
https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 I think this is the better link. Advanced Data Protection is end to end encrypted, without the key being backed up to Apple’s servers.
- bramhaag 2y ago
  This of course only helps if ADP is available in your country and you've turned it on.

procaryote 2y ago

Kinda worrying that it doesn't mention anything about how that is secured. Google Authenticator had the fun idea to opt people into unencrypted (beyond whatever regular google drive files have) cloud backup of 2fa secrets, and it's been exploited in the ways you'd expect.

izacus 2y ago
Both mobile operating systems use e2e encryption for the backups.
- Tepix 2y ago
  Not in the UK for icloud
- stavros 2y ago
  Android doesn't encrypt everything, and the details of what it does and doesn't encrypt are so fiddly that I don't feel confident enough to enable cloud backups.
  - izacus 2y ago
    Android encrypts its whole backup with E2E encryption using your PIN.
    - stavros 2y ago
      It doesn't, it encrypt some of your backup, and isn't entirely clear on which part.
- sneak 2y ago
  No, iOS backups are not e2ee unless you go and opt-in to it, which approximately 0% have done.

wongarsu 2y ago

On my Android, what's the upside of using this instead of Google Authenticator if they both back up to the same place? If they used their own cloud backend I would be a lot more interested. They could even offer to store it in their cloud end-to-end encrypted (making it my responsibility to keep the password safe). That would give me similar exposure as their password manager, which I'm already using.

TingPing 2y ago
Authenticators are a commodity at this point. None are special.
- eviks 2y ago
  This just ignores important details like multi device sync, which to few support for being "commodities"