Comment on Google Says Sorry After Passwords Vanish For 15 Million Windows Users.

krimson@lemmy.world ⁨1⁩ ⁨month⁩ ago

• redditReallySucks@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

  By storing your passwords and otp in the same place it becomes 1 factor authentification

  source

  • EddoWagt@feddit.nl ⁨1⁩ ⁨month⁩ ago

    Not really as you’re still protected from password breaches, which is most likely to happen anyways, especially if you self host.

    If you’re actively being targeted for your bitwarden password, you likely have bigger problems

    source
  • paholg@lemm.ee ⁨1⁩ ⁨month⁩ ago

    Not if you use 2 factor to access the password manager.

    source

    • faerbit@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

      It’s still just one factor. You just secured it better.

      source

      • Godnroc@lemmy.world ⁨1⁩ ⁨month⁩ ago

        To set a scene, you awake in the middle of the night because your phone is making noise. Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep. The intruder now has access to your password manager!

        They attempt to log into your bank and drain your life savings, but despite having your password it sends another prompt to your phone. This time, you wake up enough to realize something is wrong. This time, you deny the prompt.

        The entire second paragraph cannot happen if your MFA is a single factor. Don’t store MFA in your password manager!

        source

        • -> View More Comments
  • krimson@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Technically yes if my vault gets compromised I would be fucked. I have it firewalled tho and only accessible from home (or VPN to home). So should be pretty secure. I used google authenticator but found it a major pita (can’t even search entries on Android, wtf?). If they make this more user friendly I’ll gladly switch back to a seperate OTP store.

    source

    • rekorse@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I use aegis for the MFA portion.

      source
  • trolololol@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Modern problems require modern solutions

    source
• Mwa@thelemmy.club ⁨1⁩ ⁨month⁩ ago

  so no more authy? BITWARDEN HAS THAT BUILT IN??? thats AWESOME

  source

  • Hexarei@programming.dev ⁨1⁩ ⁨month⁩ ago

    So does keepass

    source
  • Allero@lemmy.today ⁨1⁩ ⁨month⁩ ago

    Yep, and Vaultwarden too!

    source

    • dan@upvote.au ⁨1⁩ ⁨month⁩ ago

      The most secure practice for any high-value accounts (email etc) is to use WebAuthn with a hardware key like a Yubikey.

      TOTP is still vulnerable to phishing (a fake login page can ask for both a password and a TOTP code) so business/corporate environments are moving away from them.

      source

      • Allero@lemmy.today ⁨1⁩ ⁨month⁩ ago

        Sure, hardware keys are superior!

        I’m only talking about best practtices when using TOTPs in particular.

        source
    • Mwa@thelemmy.club ⁨1⁩ ⁨month⁩ ago

      Alr

      source
  • qaz@lemmy.world ⁨1⁩ ⁨month⁩ ago

    It is a paid feature though if you don’t selfhost

    source

    • Mwa@thelemmy.club ⁨1⁩ ⁨month⁩ ago

      Oh

      source

      • TurdMongler@lemmy.world ⁨1⁩ ⁨month⁩ ago

        But it’s cheap! $10 a YEAR when I last checked.

        source

        • -> View More Comments
    • dan@upvote.au ⁨1⁩ ⁨month⁩ ago

      The paid features aren’t free if you self-host either. They’re free if you use Vaultwarden though.

      source
  • Dreamless4561@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

    Yep, for only $10 per year. But just make sure to keep backups of your vault and/or make an emergency kit.

    source
• WarlordSdocy@lemmy.world ⁨1⁩ ⁨month⁩ ago

  I was thinking about self hosting but I was worried it would be less secure. I don’t really know a lot about setting that kind of thing up (I do have programming experience but don’t have a lot of server hosting experience outside of doing it for games like Minecraft) and I feel like I’d mess it up and it would be a lot easier to get into than a hardened server. Especially cause the odds I get a virus or something is probably higher then the odds someone breaks into bitwarden’s server. Idk if I’m wrong about this, would love to be corrected if I am, was just my initial thoughts when I switched over from a different password manager to bitwarden.

  source

  • subtext@lemmy.world ⁨1⁩ ⁨month⁩ ago

    If you don’t trust yourself 110%, don’t host it yourself. Too risky. I self-host everything, but I leave email and passwords to someone else because it’s just too important.

    source
  • SkyeStarfall@lemmy.blahaj.zone ⁨1⁩ ⁨month⁩ ago

    I think the bigger thing to worry about is, what would happen if your server fails or is destroyed? Would you have a backup of all your passwords? And if yes, are those backups updated regularly and stored in a safe place that also won’t get destroyed if the server gets destroyed (like, say, a house fire)?

    Then, yes, you got the cybersecurity angle too

    It’s a lot to think about for something as important and fundamental to everything you do on the internet as passwords (and accounts)

    source
  • krimson@lemmy.world ⁨1⁩ ⁨month⁩ ago

    It’s pretty easy to setup using docker, you do need to know that ofcourse and how to setup dns and stuff.

    I have it firewalled so my vault is not accessible from the internet, only from home or vpn to home.

    source
• ytg@sopuli.xyz ⁨1⁩ ⁨month⁩ ago

  And it can also store passkeys

  source