I’ve been running a self-hosted Vaultwarden server with Bitwarden clients. It’s been perfect. The clients could use some usability work, but other than that, no complaints.
Not if you protect the master key with MFA, like a yubikey. Then it’s cryptographically secure for quite a while…at least until quantum computing is affordable enough to be used against your data. Or the database and your yubikey and yourbpassphrase are compromised
You’ve got a good point. I wonder if this an example of a trade-off between convenience and security. If you’re logging in and you get an MFA prompt, a Yubikey has to be physically searched, while Bitwarden or Proton Pass only have to be clicked. A Yubikey can only hold a limited amount of accounts, while Bitwarden or Proton Pass could hold many more. Of course, a Yubikey could be used as MFA for Bitwarden or Proton Pass, but that would create a single point of failure and reduce factor separation (which I think is your original point).
While I posted a Bitwarden or Proton Pass recommendation of sorts, I genuinely wonder if it’s advisable to not use MFA at all if the factors will not be separated. Or, perhaps, the best security solution is the one you’ll actually use. I guess the answer is the good ol’ “What’s your security model?”
I wonder if this an example of a trade-off between convenience and security.
I genuinely wonder if it’s advisable to not use MFA at all if the factors will not be separated. Or, perhaps, the best security solution is the one you’ll actually use
Your first and last statements are correct. Using your password manager as your MFA is a trade off with security and convenience, but that added convenience helps make it more usable so you actually use it. Anything is a trade up for most peoples’ awful password hygiene, so the trade off is worth it in my opinion.
Regarding the advisability of combining password and MFA into one platform: while you are lowering the overall security of your accounts, if you secure the main account with a long/strong password and a hardware security key, I would say that’s still more secure than not having 2FA enabled or not using secure passwords.
I like 1Password’s built in MFA support, if it’s a really sensitive account I use Google Authenticator because I haven’t bothered researching better local alternative
Edit: Going to try Aegis for the more sensitive logins, looks like what I’m looking for
Possibly not now that it saves your codes to your google account (it didn’t use to), but it made me uncomfortable for my password manager to have both factors together to log into something like my bank or root AWS account. So you’d have to compromise two different places to get in
I use this on my windows machines, offline , has biometrics, supports export and import from aegis. Is new and untested but past few months have been solid.
You can store the TOPT codes on them, but then you can also do all the higher security things too.
No one’s breaking into your Google account if you secure it with those keys and remove the sms backup method unless they’ve physically stolen the yubikey
KeePassXC does have this functionality on desktop as well as on SOME android apps (no idea for iOS). For android I like KeePass2Android Offline, iirc it was recommended on the official KeePassXC website (you may want to check it out).
Now that authy has fucked us over with this, what should I move my 2fa codes into, any recommendations?
Unfortunately I can’t use aegis on iOS/windows, does keepass have this functionality?
Bitwarden would be my vote
I’ve been running a self-hosted Vaultwarden server with Bitwarden clients. It’s been perfect. The clients could use some usability work, but other than that, no complaints.
This
Aegis
These are not local solutions, but are cross-platform and open source: Bitwarden or Proton Pass.
Doesn’t synced solutions completely defeat the purpose of MFA?
Not if you protect the master key with MFA, like a yubikey. Then it’s cryptographically secure for quite a while…at least until quantum computing is affordable enough to be used against your data. Or the database and your yubikey and yourbpassphrase are compromised
You’ve got a good point. I wonder if this an example of a trade-off between convenience and security. If you’re logging in and you get an MFA prompt, a Yubikey has to be physically searched, while Bitwarden or Proton Pass only have to be clicked. A Yubikey can only hold a limited amount of accounts, while Bitwarden or Proton Pass could hold many more. Of course, a Yubikey could be used as MFA for Bitwarden or Proton Pass, but that would create a single point of failure and reduce factor separation (which I think is your original point).
While I posted a Bitwarden or Proton Pass recommendation of sorts, I genuinely wonder if it’s advisable to not use MFA at all if the factors will not be separated. Or, perhaps, the best security solution is the one you’ll actually use. I guess the answer is the good ol’ “What’s your security model?”
Your first and last statements are correct. Using your password manager as your MFA is a trade off with security and convenience, but that added convenience helps make it more usable so you actually use it. Anything is a trade up for most peoples’ awful password hygiene, so the trade off is worth it in my opinion.
Regarding the advisability of combining password and MFA into one platform: while you are lowering the overall security of your accounts, if you secure the main account with a long/strong password and a hardware security key, I would say that’s still more secure than not having 2FA enabled or not using secure passwords.
I like 1Password’s built in MFA support, if it’s a really sensitive account I use Google Authenticator because I haven’t bothered researching better local alternative
Edit: Going to try Aegis for the more sensitive logins, looks like what I’m looking for
You are not any more secure with google authenticator for 2fa, are you?
Possibly not now that it saves your codes to your google account (it didn’t use to), but it made me uncomfortable for my password manager to have both factors together to log into something like my bank or root AWS account. So you’d have to compromise two different places to get in
https://news.itsfoss.com/ente-auth/
I use this on my windows machines, offline , has biometrics, supports export and import from aegis. Is new and untested but past few months have been solid.
Most decent password managers (e.g. 1Password, Proton Pass) have MFA built-in. Use those.
I’d recommend 2FAS Auth
Buy a few (at least 2 for a backup) yubikeys.
Much more secure.
You can store the TOPT codes on them, but then you can also do all the higher security things too.
No one’s breaking into your Google account if you secure it with those keys and remove the sms backup method unless they’ve physically stolen the yubikey
I’m using aegis, but maybe Proton Pass could be good?
KeePassXC does have this functionality on desktop as well as on SOME android apps (no idea for iOS). For android I like KeePass2Android Offline, iirc it was recommended on the official KeePassXC website (you may want to check it out).
deleted by creator