Comment on Google Says Sorry After Passwords Vanish For 15 Million Windows Users.

• EddoWagt@feddit.nl ⁨3⁩ ⁨months⁩ ago

  Not really as you’re still protected from password breaches, which is most likely to happen anyways, especially if you self host.

  If you’re actively being targeted for your bitwarden password, you likely have bigger problems

  source
• paholg@lemm.ee ⁨3⁩ ⁨months⁩ ago

  Not if you use 2 factor to access the password manager.

  source

  • faerbit@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

    It’s still just one factor. You just secured it better.

    source

    • Godnroc@lemmy.world ⁨3⁩ ⁨months⁩ ago

      To set a scene, you awake in the middle of the night because your phone is making noise. Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep. The intruder now has access to your password manager!

      They attempt to log into your bank and drain your life savings, but despite having your password it sends another prompt to your phone. This time, you wake up enough to realize something is wrong. This time, you deny the prompt.

      The entire second paragraph cannot happen if your MFA is a single factor. Don’t store MFA in your password manager!

      source

      • subtext@lemmy.world ⁨3⁩ ⁨months⁩ ago

        I mean yeah it’s less secure than if they were separated. But my mom is never going to use a separate app for passwords and 2FA, so the two in one app is still better than nothing.

        source
      • Hexarei@programming.dev ⁨3⁩ ⁨months⁩ ago

        If your MFA is stored in your password manager, you’re not getting prompts to your phone about it. You’re just prompted for a otp code that you have to go out of your way to copy/paste or type in from the manager.

        source
      • Telorand@reddthat.com ⁨3⁩ ⁨months⁩ ago

        Bruh, if my phone is sending me notifications in the middle of the night, the first thing I’m doing is uninstalling whatever app is sending me notifications.

        If people are that gullible to fall prey to an attack like this, managing OTP in two apps is probably more than they can handle anyway. Everybody has a different threat model, and it’s okay if it’s not covered by hardware passkeys and locally hashed and managed databases.

        source
      • JackbyDev@programming.dev ⁨3⁩ ⁨months⁩ ago

        Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep.

        The idea that people would approve that is wild to me.

        source
• krimson@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Technically yes if my vault gets compromised I would be fucked. I have it firewalled tho and only accessible from home (or VPN to home). So should be pretty secure. I used google authenticator but found it a major pita (can’t even search entries on Android, wtf?). If they make this more user friendly I’ll gladly switch back to a seperate OTP store.

  source

  • rekorse@lemmy.world ⁨3⁩ ⁨months⁩ ago

    I use aegis for the MFA portion.

    source
• trolololol@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Modern problems require modern solutions

  source