you are viewing a single comment's thread
view the rest of the comments
[–] 7 points 1 day ago (9 children)

For 2FA: Find a good password manager. They can also handle TOTP (the algorithm most 2FA implementations use), so you just autofill user & password, then autofill the TOTP, done. I use KeePassXC + sync the DB, but there are plenty of other trustworthy password managers. Plus, if you get in the habit of generating secure passwords using the password manager, one leaked login doesn't cost you all of them.

  • source
  • hideshow 9 child comments
  • [–] 9 points 1 day ago (8 children)

    The second you put totp codes into bitwarden, it's no longer mfa.

  • source
  • parent
  • hideshow 8 child comments
  • [–] [S] 1 point 1 day ago (4 children)

    Also, it can still be MFA which is the way I use it.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 10 points 23 hours ago (3 children)

    What they're saying is that if all of the multiple factors are stored behind 1 master password in 1 service, the whole purpose of MFA is negated. You've just shifted the single point of failure from a website password to your Bitwarden master password.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 23 hours ago (2 children)

    True, but to access bitwarden you need a device already logged in to bitwqrden or the TOTP for bitwarden, so effectively overly 2FA.

    Also, the purpose of a password manager is unique secure passwords, so most users start off more secure.

  • source
  • parent
  • hideshow 2 child comments
  • [–] -1 points 22 hours ago (1 child)

    You're not wrong at all that it's still more secure than most. But it's still not mfa in that case unless you have separate mfa to get into Bitwarden/LastPass/etc, THEN you could make an argument that it's mfa by proxy.

  • source
  • parent
  • hideshow 1 child comment
  • [+] [S] 1 point 1 day ago (2 children)
  • [–] 1 point 12 hours ago

    You all guys simply don’t understand the idea. The idea to not have two or ten password managers. The idea is for the website being compromised, TOTP password won’t compromise the algorithm. Having just one password, stealing it, poof. Having them two, big difference. That’s the idea. They are different. Yes, many sites and services fuck up that by, say, sending them both to your email or something like that. But putting your TOTP into your password manager does not change much into the worse. Not issuing that 2nd password is what makes you less secure.

  • source
  • parent
  • load more comments (-1 replies)