Does anyone know why there are no dedicated Authenticator apps made by for example Proton or Bitwarden?
I’m aware that they have TOTP baked into their password managers but you still need to have at least one separate solution to log into your vault.
I have a yubikey for the Bitwarden vault as second factor
Why do you need that? Just use one of the already existing ones like Aegis.
When have more options become a bad thing?
Bitwarden has otp built in but you have to buy premium. Totally worth it.
Should probably mention that premium is only 10 bucks a year. I also don’t just pay for the feature itself but also to support Bitwarden, it’s completely free and open source after all.
Same. 10 bucks is a steal.
The best authenticator is https://github.com/jamie-mh/AuthenticatorPro
FOSS.
Didn’t realise you could have a good authenticator until I used this.
Kinda think its to keep costs down. They already have their builtin totp generators so making a separate application seems kinda redundant. Unless you mean why they don’t make their own hardware security key? That’s probably also to keep costs down (materials, vendors, marketing, upkeep, etc…). I would also like to have a rival with the same credibility for yubikey though in case something happens to the company.
Why do you need a separate one?
deleted by creator
No. If anyone has access to your email or master password, they can simply reset any other account. How would your difficult (one time used) password of protonmail be leaked? Proton doesn’t have it. Only if you’ve got powerful malware on your device and then it doesn’t matter in which app your shit is stored.
deleted by creator
I think they are suggesting the abality to reset 2fa for a service if they have access to your email.
Let’s say your database contains your email service, and bank account without 2fa. Let’s also assume they got acess to your email through a sham site that had you type credentials in and 2fa.
Hacker gets database.
They can login into your email and use the recovery code the bank send to your email for “lost my 2fa”. (And delete the mail notifications as they come in, hopefully before you catch on)
A bank (should) have additional steps such as phone number, or a real recovery key you were supposed to write down, but a random online store or entertainment site will probably will just reset the 2fa and the hacker can go from there.
Realsisticlly we should be using at least 3 password database files with different master passwords for better security.
- Account logins and passwords
- TOTP
- Any 2fa recovery keys.
However in practice, that is a pain in the ass and if someome has taken the time to breach your 1 specific database instead of going after easier targets, they probably have all your databases.
I keep google authenticator around just to store bitwarden’s totp. But I also store bitwarden’s totp inside bitwarden, so I can use bitwarden’s mobile client to get bitwarden’s totp when I log into bitwarden on another device.
That’s what I’d recommend. Why Google and not Aegis or another non-Google FOSS app?
Nothing in particular, all my totp was in google authenticator and over the years I migrated them all to lastpass then bitwarden, and the only thing left there is now bitwarden totp.
Sound like a ‘yo, dawg’-meme
