• stealth_cookies@lemmy.ca
        link
        fedilink
        English
        arrow-up
        13
        ·
        9 months ago

        It is a bad idea to have your password manager and 2FA be the same app though. You want to spread it around so one attack can’t break your logins.

        • BearOfaTime@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          9 months ago

          Good point.

          Is it realistic (i.e. is it secure enough) to self-host 2 Bitwarden, one for passwords, one for authentication?

          Or would splitting that between 2 Bitwarden logins work?

          I just throwing stuff at the wall, I haven’t thought either of these through yet.

        • Norgur@kbin.social
          link
          fedilink
          arrow-up
          1
          ·
          9 months ago

          While that is true, the risk of someone brute forcing into an account of mine on the login side than on mine. That’s what I use 2FA against. If they managed to break into my vault, they’d have broken into my Mailserver and whatnot, so…

      • bdonvr@thelemmy.club
        link
        fedilink
        English
        arrow-up
        4
        ·
        9 months ago

        Yeah, I already run Vaultwarden. But like others I don’t really want to combine my tokens and passwords.

    • Justin@lemmy.jlh.name
      link
      fedilink
      English
      arrow-up
      3
      ·
      9 months ago

      I just use FreeOTP+ on my phone. It’s a fork of a Red Hat authenticator, and completely open source and available on F-Droid.

      No sync, but you can export the TOTP secrets if you want to back them up/move them.

    • StarDreamer@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      9 months ago

      Bitwarden has TOTP support with a pro license. Or you can just selfhost (using vaultwarden) and have all the features instead.