ššŖš³š¬The OTP you want to use was already used
infinitevalenceNo and stop using SMS itās not secure.
andreluis034Although itās true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesnāt matter. It still is doing itās job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).
I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).
philomoryThatās not quite right though, thereās the factor you know (password to your vault), and the factor you have (a copy of the encrypted vault).
Admittedly, I donāt use that feature either, but, itās not as bad as it seems at first glance.
Thatās not quite right though, thereās the factor you know (password to your vault), and the factor you have (a copy of the encrypted vault).
That would be true for offline vaults, but for services hosted on internet I donāt think so. Assuming the victim does not use 2FA on their Bitwarden account, all an attacker needs is the victimās credentials (email and password). Once you present the factor you know, the vault is automatically downloaded from their services. This is something I hadnāt thought until know, but I guess password managers might(?) change the factor type from something you know (the password in your head) to something you have (the vault). At which point, if you have 2FA enabled on other services, you are authenticating with 2 things you have, the vault and your phone.Assuming the victim does not use 2FA on their Bitwarden account
A pretty tall assumption given that we're already talking about someone who knows to turn on 2FA for other things. If someone knows about 2FA and password managers, they'd be insane not to have 2FA set up on the password manager itself.
Thatās a fair point. I just wanted to highlight that there may be cases where a password manager isnāt automatically protected by 2FA by the two factors you mentioned (The password you know and the copy of the vault) since in the case of bitwarden fulfilling one can give you the second. In order to have ātrueā 2FA you would need to enable OTPs.
Certainly fair.
And yeah, I personally use Bitwarden with 2FA on the Bitwarden account, but don't store any 2FA tokens in Bitwarden, handling them all separately. Don't want all the eggs in one basket.
Though given I have fingerprint access on phone and computer for bitwarden, i suppose that one basket is my finger. But if someone is taking my finger, I've got more immediate concerns than my passwords.