26 ms·

It doesn’t support syncing between devices. An alternative is Ente Auth: https://news.ycombinator.com/item?id=40883839 https://news.ycombinator.com/item?id=408

by layer8 2y ago

It doesn’t support syncing between devices. An alternative is Ente Auth: https://news.ycombinator.com/item?id=40883839 https://news.ycombinator.com/item?id=40883839 Edit: Since there seems to be some confusion, this submission is about Bitwarden Authenticator, a free mobile app for TOTP, not about the Bitwarden password manager, which does support syncing, and which in the paid Premium plan also includes an authenticator.

satvikpendem 2y ago
I use this, it works great for when you're on a laptop and can't be bothered to pull out your phone to enter the 2FA code (because it works cross-platform on web, desktop, and mobile, all syncing together). Yes, technically this is a corruption of the principles of why you'd need 2FA in the first place, as the second factor is obviated when everything is on one device, but I find the risk acceptable, no one is going to hack into my laptop at home, and if they do, I have bigger things to worry about than 2FA.
- Marsymars 2y ago
  > Yes, technically this is a corruption of the principles of why you'd need 2FA in the first place I understand what you’re saying here, but then having a password manager and a 2FA app on the same phone is the exact same corruption. If your threat model involves “don’t have your 2FA codes on your desktop”, it must also include “don’t have your passwords on your phone”.
  - satvikpendem 2y ago
    That's probably true. For what it's worth I don't save passwords on my phone either.
magixx 2y ago
Can you elaborate? The android app, browser extension, and desktop app all keep in sync for me.
- riffraff 2y ago
  Are you talking of bit warden password manager or bitwarden authenticator? The latter does not seem to have a desktop version.
nopenicetry 2y ago
[dead]
rectang 2y ago
I've been using Authy for TOTP in conjunction with Bitwarden Premium for passwords. I considered using Bitwarden Premium for TOTP, but dislike having passwords and TOTP codes in a single-point-of-failure backup location. I looked into Bitwarden Authenticator, but it didn't seem to support sync between devices, as you've now corroborated. This is the reason I gave up on Google Authenticator and switched to Authy — I don't want to have to deal with trying to get all my accounts unlocked if my phone gets lost, broken, or stolen. I've set up Authy with a backup password so that I can recover it if necessary. I understand that this is less secure, and Twilio (the company behind Authy) seems to have a mixed reputation. However my reasoning is that maintaining two layers which are separate (Authy on phone and tablet, Bitwarden on laptop) is consistent with defense-in-depth theory — even if the layers have some weaknesses. Maybe it's time to switch to Yubikey, because TOTP apps that don't sync between devices are too high of a risk for losing access, and TOTP apps that sync aren't quite "something you have". How do people prepare for the potential loss of Yubikeys? Is it reasonable to get a spare[1] and keep it in a safety deposit box? [1] https://www.yubico.com/products/spare/ https://www.yubico.com/products/spare/
- WheatMillington 2y ago
  Google Authenticator supports backing up to Google Drive.
  - deleted 2y ago
    [deleted]
  - rectang 2y ago
    Indeed, it looks like this feature was added in April 2023: https://security.googleblog.com/2023/04/google-authenticator-now-supports.html https://security.googleblog.com/2023/04/google-authenticator... I still have Google Authenticator on my phone, but I hadn't been using it. I see that you now must choose between using it "with an account", in which case your codes are saved "to your account", or using it without an account. I just installed Google Authenticator onto my tablet, selected that I would "continue as [Google Account]), and voila, there are all my codes. I presume that if you use it "without an account", the codes are not backed up, although I'm not going to test that now. I am curious what backed up "to your account" means. I'm often logged into Google on my laptop — is it possible to access the TOTP codes from there? If my laptop is hacked it would be a disaster, and I at least want to reduce the blast radius so that accounts requiring MFA are out of reach to the hacker unless they also hack my phone or tablet.
deleted 2y ago
[deleted]
cedws 2y ago
I'm not sure that syncing is a feature that should exist. Once an OTP shared secret has been added to a device, it should be unretrievable, ideally stored in a security enclave. If you can just clone an OTP to as many devices as you want then I'd argue it's not really two-factor. The mechanism used to sync is the same one a malicious actor would use to clone all your OTP entries and gain access to your accounts.
- cr125rider 2y ago
  That’s fair. Can I have it backup sync to iCloud so I’d lose my phone I can get a new one? I think that’s a usability vs. security risk we’re gonna have to be okay with. People aren’t going to be able to have multiple devices.
  - cedws 2y ago
    >Can I have it backup sync to iCloud so I’d lose my phone I can get a new one? Then your accounts are only as secure as your iCloud account, which I wouldn't count on, and you've undermined the purpose of 2FA entirely. There's no way around this - 2FA needs to be bound to a single physical device if you want to benefit from it.
    - JumpCrisscross 2y ago
      > your accounts are only as secure as your iCloud account, which I wouldn't count on, and you've undermined the purpose of 2FA entirely This is extreme. Uploading your 2FA to an encrypted cloud like iCloud widens your circle of trust. But it also increases convenience and utility. I personally take the best of both worlds. A synced 2FA for most accounts. And a locked one for my critical ones, e.g. 1PW. If I couldn't sync any accounts I wouldn't bother turning on 2FA for most because the downside is low and, ultimately, probably someone else's problem to clean up.
    - Marsymars 2y ago
      > There's no way around this - 2FA needs to be bound to a single physical device if you want to benefit from it. Depends what the benefit is. From the PoV of my bank, the benefit is that people who use “Password123!” for all of their accounts don’t get their accounts trivially compromised. From my PoV, the benefit of TOTP 2FA is that my password manager can fill it all in automatically rather than having to find my phone and type in SMS numbers manually. (As a non-iOS user - if you’re on iOS you can have your SMS 2FA codes put in automatically.)
matthberg 2y ago
It's on their feature roadmap [0] and already supported by the full Bitwarden app (as a paid feature) [1]. 0: https://bitwarden.com/products/authenticator/#:~:text=New%20features%20on%20the%20roadmap,%20syncing%20to%20Bitwarden%20accounts https://bitwarden.com/products/authenticator/#:~:text=New%20... - "New features on the roadmap include import, syncing to Bitwarden accounts, push-based 2FA, and account recovery" 1: https://bitwarden.com/pricing/#:~:text=Integrated%20Authenticator%20(TOTP) https://bitwarden.com/pricing/#:~:text=Integrated%20Authenti...
tw04 2y ago
+1 for ente. Love that it’s cross platform, and while this is a unique app from Bitwarden, I like having a separate vendor for totp vs passwords.

by layer8 2y ago

satvikpendem 2y ago

I use this, it works great for when you're on a laptop and can't be bothered to pull out your phone to enter the 2FA code (because it works cross-platform on web, desktop, and mobile, all syncing together). Yes, technically this is a corruption of the principles of why you'd need 2FA in the first place, as the second factor is obviated when everything is on one device, but I find the risk acceptable, no one is going to hack into my laptop at home, and if they do, I have bigger things to worry about than 2FA.

Marsymars 2y ago
> Yes, technically this is a corruption of the principles of why you'd need 2FA in the first place I understand what you’re saying here, but then having a password manager and a 2FA app on the same phone is the exact same corruption. If your threat model involves “don’t have your 2FA codes on your desktop”, it must also include “don’t have your passwords on your phone”.
- satvikpendem 2y ago
  That's probably true. For what it's worth I don't save passwords on my phone either.

magixx 2y ago

Can you elaborate? The android app, browser extension, and desktop app all keep in sync for me.

riffraff 2y ago
Are you talking of bit warden password manager or bitwarden authenticator? The latter does not seem to have a desktop version.

nopenicetry 2y ago

[dead]

rectang 2y ago

I've been using Authy for TOTP in conjunction with Bitwarden Premium for passwords. I considered using Bitwarden Premium for TOTP, but dislike having passwords and TOTP codes in a single-point-of-failure backup location. I looked into Bitwarden Authenticator, but it didn't seem to support sync between devices, as you've now corroborated. This is the reason I gave up on Google Authenticator and switched to Authy — I don't want to have to deal with trying to get all my accounts unlocked if my phone gets lost, broken, or stolen. I've set up Authy with a backup password so that I can recover it if necessary. I understand that this is less secure, and Twilio (the company behind Authy) seems to have a mixed reputation. However my reasoning is that maintaining two layers which are separate (Authy on phone and tablet, Bitwarden on laptop) is consistent with defense-in-depth theory — even if the layers have some weaknesses. Maybe it's time to switch to Yubikey, because TOTP apps that don't sync between devices are too high of a risk for losing access, and TOTP apps that sync aren't quite "something you have". How do people prepare for the potential loss of Yubikeys? Is it reasonable to get a spare[1] and keep it in a safety deposit box? [1] https://www.yubico.com/products/spare/ https://www.yubico.com/products/spare/

WheatMillington 2y ago
Google Authenticator supports backing up to Google Drive.
- deleted 2y ago
  [deleted]
- rectang 2y ago
  Indeed, it looks like this feature was added in April 2023: https://security.googleblog.com/2023/04/google-authenticator-now-supports.html https://security.googleblog.com/2023/04/google-authenticator... I still have Google Authenticator on my phone, but I hadn't been using it. I see that you now must choose between using it "with an account", in which case your codes are saved "to your account", or using it without an account. I just installed Google Authenticator onto my tablet, selected that I would "continue as [Google Account]), and voila, there are all my codes. I presume that if you use it "without an account", the codes are not backed up, although I'm not going to test that now. I am curious what backed up "to your account" means. I'm often logged into Google on my laptop — is it possible to access the TOTP codes from there? If my laptop is hacked it would be a disaster, and I at least want to reduce the blast radius so that accounts requiring MFA are out of reach to the hacker unless they also hack my phone or tablet.

deleted 2y ago

[deleted]

cedws 2y ago

I'm not sure that syncing is a feature that should exist. Once an OTP shared secret has been added to a device, it should be unretrievable, ideally stored in a security enclave. If you can just clone an OTP to as many devices as you want then I'd argue it's not really two-factor. The mechanism used to sync is the same one a malicious actor would use to clone all your OTP entries and gain access to your accounts.

cr125rider 2y ago
That’s fair. Can I have it backup sync to iCloud so I’d lose my phone I can get a new one? I think that’s a usability vs. security risk we’re gonna have to be okay with. People aren’t going to be able to have multiple devices.
- cedws 2y ago
  >Can I have it backup sync to iCloud so I’d lose my phone I can get a new one? Then your accounts are only as secure as your iCloud account, which I wouldn't count on, and you've undermined the purpose of 2FA entirely. There's no way around this - 2FA needs to be bound to a single physical device if you want to benefit from it.
  - JumpCrisscross 2y ago
    > your accounts are only as secure as your iCloud account, which I wouldn't count on, and you've undermined the purpose of 2FA entirely This is extreme. Uploading your 2FA to an encrypted cloud like iCloud widens your circle of trust. But it also increases convenience and utility. I personally take the best of both worlds. A synced 2FA for most accounts. And a locked one for my critical ones, e.g. 1PW. If I couldn't sync any accounts I wouldn't bother turning on 2FA for most because the downside is low and, ultimately, probably someone else's problem to clean up.
  - Marsymars 2y ago
    > There's no way around this - 2FA needs to be bound to a single physical device if you want to benefit from it. Depends what the benefit is. From the PoV of my bank, the benefit is that people who use “Password123!” for all of their accounts don’t get their accounts trivially compromised. From my PoV, the benefit of TOTP 2FA is that my password manager can fill it all in automatically rather than having to find my phone and type in SMS numbers manually. (As a non-iOS user - if you’re on iOS you can have your SMS 2FA codes put in automatically.)

matthberg 2y ago

It's on their feature roadmap [0] and already supported by the full Bitwarden app (as a paid feature) [1]. 0: https://bitwarden.com/products/authenticator/#:~:text=New%20features%20on%20the%20roadmap,%20syncing%20to%20Bitwarden%20accounts https://bitwarden.com/products/authenticator/#:~:text=New%20... - "New features on the roadmap include import, syncing to Bitwarden accounts, push-based 2FA, and account recovery" 1: https://bitwarden.com/pricing/#:~:text=Integrated%20Authenticator%20(TOTP) https://bitwarden.com/pricing/#:~:text=Integrated%20Authenti...

tw04 2y ago

+1 for ente. Love that it’s cross platform, and while this is a unique app from Bitwarden, I like having a separate vendor for totp vs passwords.