so no more authy? BITWARDEN HAS THAT BUILT IN??? thats AWESOME
Comment on Google Says Sorry After Passwords Vanish For 15 Million Windows Users.
krimson@lemmy.world 3 months ago
Recently started using Bitwarden and it works really well. You can even ditch authenticator because it has OTP built in too.
I selfhost it though because I trust nobody with this type of sensitive data, encrypted or not.
Mwa@thelemmy.club 3 months ago
Hexarei@programming.dev 3 months ago
So does keepass
Allero@lemmy.today 3 months ago
Yep, and Vaultwarden too!
dan@upvote.au 3 months ago
The most secure practice for any high-value accounts (email etc) is to use WebAuthn with a hardware key like a Yubikey.
TOTP is still vulnerable to phishing (a fake login page can ask for both a password and a TOTP code) so business/corporate environments are moving away from them.
Allero@lemmy.today 3 months ago
Sure, hardware keys are superior!
I’m only talking about best practtices when using TOTPs in particular.
Mwa@thelemmy.club 3 months ago
Alr
qaz@lemmy.world 3 months ago
It is a paid feature though if you don’t selfhost
Mwa@thelemmy.club 3 months ago
Oh
TurdMongler@lemmy.world 3 months ago
But it’s cheap! $10 a YEAR when I last checked.
dan@upvote.au 3 months ago
The paid features aren’t free if you self-host either. They’re free if you use Vaultwarden though.
Dreamless4561@sh.itjust.works 3 months ago
Yep, for only $10 per year. But just make sure to keep backups of your vault and/or make an emergency kit.
WarlordSdocy@lemmy.world 3 months ago
I was thinking about self hosting but I was worried it would be less secure. I don’t really know a lot about setting that kind of thing up (I do have programming experience but don’t have a lot of server hosting experience outside of doing it for games like Minecraft) and I feel like I’d mess it up and it would be a lot easier to get into than a hardened server. Especially cause the odds I get a virus or something is probably higher then the odds someone breaks into bitwarden’s server. Idk if I’m wrong about this, would love to be corrected if I am, was just my initial thoughts when I switched over from a different password manager to bitwarden.
subtext@lemmy.world 3 months ago
If you don’t trust yourself 110%, don’t host it yourself. Too risky. I self-host everything, but I leave email and passwords to someone else because it’s just too important.
SkyeStarfall@lemmy.blahaj.zone 3 months ago
I think the bigger thing to worry about is, what would happen if your server fails or is destroyed? Would you have a backup of all your passwords? And if yes, are those backups updated regularly and stored in a safe place that also won’t get destroyed if the server gets destroyed (like, say, a house fire)?
Then, yes, you got the cybersecurity angle too
It’s a lot to think about for something as important and fundamental to everything you do on the internet as passwords (and accounts)
krimson@lemmy.world 3 months ago
It’s pretty easy to setup using docker, you do need to know that ofcourse and how to setup dns and stuff.
I have it firewalled so my vault is not accessible from the internet, only from home or vpn to home.
ytg@sopuli.xyz 3 months ago
And it can also store passkeys
redditReallySucks@lemmy.dbzer0.com 3 months ago
By storing your passwords and otp in the same place it becomes 1 factor authentification
EddoWagt@feddit.nl 3 months ago
Not really as you’re still protected from password breaches, which is most likely to happen anyways, especially if you self host.
If you’re actively being targeted for your bitwarden password, you likely have bigger problems
paholg@lemm.ee 3 months ago
Not if you use 2 factor to access the password manager.
faerbit@sh.itjust.works 3 months ago
It’s still just one factor. You just secured it better.
Godnroc@lemmy.world 3 months ago
To set a scene, you awake in the middle of the night because your phone is making noise. Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep. The intruder now has access to your password manager!
They attempt to log into your bank and drain your life savings, but despite having your password it sends another prompt to your phone. This time, you wake up enough to realize something is wrong. This time, you deny the prompt.
The entire second paragraph cannot happen if your MFA is a single factor. Don’t store MFA in your password manager!
krimson@lemmy.world 3 months ago
Technically yes if my vault gets compromised I would be fucked. I have it firewalled tho and only accessible from home (or VPN to home). So should be pretty secure. I used google authenticator but found it a major pita (can’t even search entries on Android, wtf?). If they make this more user friendly I’ll gladly switch back to a seperate OTP store.
rekorse@lemmy.world 3 months ago
I use aegis for the MFA portion.
trolololol@lemmy.world 3 months ago
Modern problems require modern solutions