I’ve been running a self-hosted Vaultwarden server with Bitwarden clients. It’s been perfect. The clients could use some usability work, but other than that, no complaints.
Comment on Authy got hacked, and 33 million user phone numbers were stolen
CaptPretentious@lemmy.world 4 months agoBitwarden would be my vote
riplin@lemm.ee 4 months ago
geography082@lemm.ee 4 months ago
This
kahdbrixk@feddit.de 4 months ago
Just out of curiosity: is it wise to keep you MFA within your password safe? Like is that not the opposite of multi factor? I’m no troll, I’m seriously uninformed.
AProfessional@lemmy.world 4 months ago
Realistically the threat we care about is others leak your password. So it doesn’t matter.
If you have a setup where your password vault is at risk the. Yes it’s a bad idea.
CaptPretentious@lemmy.world 4 months ago
I suppose there is a certain level of risk but that’s true with any solution. Passwords generally don’t get changed very often and that’s usually what’s going to be nabbed up by somebody that in your username of course. With TOTP, putting that in bitwarden means that in order to get access to whatever account, they first have to get your credentials which they probably got from a dump filled with a bunch of other credentials, then I’d have to figure out that you’re using bitwarden was your be no sign that you are. Then they’d have to actually get into your bitwarden which if you’re doing it properly should be difficult. And if the login to bitwarden is completely different than the account are trying to get into it’s basically invisible to them.
The only way I see bitwarden being the weak link, is 1. Someone has physical access to your devices and they know what they’re looking for (in this case it’s probably a roommate or family or friend, someone that you trust but probably shouldn’t). 2. Bitwarden gets compromised (which is an impossible but it is probably more difficult because it is an open source thing). 3. You go to shady website and install shady stuff and that install some sort of keylogger, or something else that shows what your system has (hell, Microsoft recall would actually fall into this category) and a back actor sees that you have bitwarden and how you log into it. But that being said, 1 and 3 aren’t necessarily stopped by having a password manager solution and the separate MFA solution… But it could slow them down.
But physical MFA isn’t impervious either. I don’t recall if it was yubiki or Google’s Titan, if I remember back years ago one of them had a problem.