If you get Bitwarden pro (really cheap), you can save an OTP link together with the site credentials, it’s really good for keeping everything in one place
You’re absolutely right. It’s all about your threat model, how much convenience you’re willing to lose and what not.
I absolutely should do more to minimize potential risk, but it’s really so convenient to just… Have it all in 1 place…
This is a smart solution. Only solution I have so far is self hosting bitwarden, using unique password to login, and having 2fa to login to bitwarden, where the key is in bitwarden, and on aegis on a phone at home.
This isn’t really a good idea because then you’re putting all your eggs in one basket. The whole point of 2FA is that the second factor is in a separate location so if your first factor (password) gets compromised the second one (OTP code) still protects your account. If both factors are in one place you’re back to a single point of failure instead of 2, losing a key benefit of 2FA.
If you’re gonna do this, at the very least have 2FA with a security key on your bitwarden vault.
You lose security, sure. But you are gaining so much more ease of use. Bitwarden autofills your credentials and puts your token into your clipboard. Also it syncs your tokens to all devices. Effectifly this makes a site as easy to login as a site without 2fa.
The alternative is on desktop always get your smartphone, open some app type a token or on the phone to switch to multiple apps to get your credentials.
Not fun imho.
I currently activated 2fa on over 60 sites, I doubt I would use it as much without BW.
For me, the key benefit of 2Fa is getting more security against leaked, stolen, phished passwords, and that still holds up.
The alternative is on desktop always get your smartphone, open some app type a token or on the phone to switch to multiple apps to get your credentials.
Not fun imho.
There are desktop apps for OTP, you don’t need a phone. And since you only need to setup an OTP secret once, doing it for your phone and pc isn’t that big of a deal.
I have my OTP secrets in 3 places, 2 yubikeys and my phone’s authenticator app, with the former meant for my PC.
For me, the key benefit of 2Fa is getting more security against leaked, stolen, phished passwords, and that still holds up.
If your vault doesn’t have 2FA too this doesn’t hold up though. Means you’re trusting a single service that can get hacked with all your secrets. Sure, your other accounts are more protected against leaks and stuff, but if your password vault isn’t, you didn’t really change much, just pointed the hackers to one single place.
Yes I know hacking a password vault isn’t some walk in the park and rarely happens, but the point is any leaks from it would be 10 times more catastrophic for you if all your OTP secrets are also stored in it. I’ll spare myself from that nightmare with the small inconvenience that is a separate, offline OTP app.
I self host Bitwarden (Vaultwarden) so I just use the built-in TOTP authenticator in the Bitwarden app. It’s nice to have it all in one place + having auto copy and paste when I log in. And because I self host, it’s all backed up securely and with (as far as I know) no real backdoors.
ETA: just realized what community this is in.
people that replied to me I’m sorry lmao, I’m not a nut about this kinda stuff and I’m by no means recommending this just like using it this way for convenience factor and to keep the likes of google out of my password.
I do the same thing. And Bitwarden’s 2FA is off my phone. In a complicated world, it’s reasonable to keep 1 password + 2FA as secure as possible. I simply can’t handle the hassle of pulling out my phone for every 2FA login, but still value the protection 2FA + randomly generated passwords provide.
No, please do not do this. Two factor authentication should be just that: two separate factors of authenticating yourself. Having them combined in one is the same as one factor.
Said in the reply to the other comment here, but I don’t really self host for security/privacy sake. And in addition to that comment I’d also like to say that I do use a YubiKey when possible for MFA. I’m not a security nut enough to care about TOTP (which kinda sucks anyway) all too much but for important things I do use physical MFA.
U2F on Bitwarden, in principle, doesn’t guard against attackers breaching into your accounts, as the Yubikey serves as a second factor during the authentication stage when the Bitwarden app retrieves the encrypted vault. Unless you combine a static secret from the Yubikey into the master password of the vault, an attacker could, in theory, steal your encrypted vault from the central Bit/Vaultwarden server or any device that’s already downloaded it (note that if this device is your phone, all conventional TOTP is thwarted anyways, so in general phones are the most lucrative target here.) From there, the strength of your master password becomes the only thing separating an attacker from access to all of your online accounts.
I’m not saying that it’s a bad practice and you absolutely shouldn’t do it — I do it myself, as I trust the security of Bitwarden’s servers and my devices in keeping my vault safe. The salient point here is the burden lies on online services upgrading their outdated security options to support U2F, not on us settling with an objectively inferior 2FA option because these services are too lazy and slow.
Fair, although I’ve said in a comment on this account somewhere else, I self host more for convenience sake than anything. I just like having my own password manager, sure it’s not as secure to use it for MFA but it’s better than giving my passwords to Google, LastPass, etc. and then using eg Google Authenticator. Self hosting is more a corporate distrust thing than a privacy thing for me
Been using it for a while as the 2FA app used and recommended by Leo Laporte. I’ve had a good experience with it, but if it has any issues, I would love to know.
From what I can tell, 2FAS basically comes with the reasons people want Authy, with only some of the downsides. Cloud sync between devices is neat, but it adds a potential vector for attack (which is just inherent to the process).
Since it’s nice and easy to move to any device, I hadn’t really noticed that yet. I dislike when people put sneaky walls up to keep me from my own data
FreeOTP is what you’re talking about, right? It’s “Maintained by RedHat, and based on Google Authenticator.” So it’s under the control of a major open source group. I wouldn’t be worried. It’s not like or Firefox, where fork developers have to play catch-up.
Incredibly based.
Come to think of it, it’s sad how we’ve got so accustomed to be suggested Google Authenticator and the other big corp data funnel 2FA apps by the services that support it
That depends. More of the popular ones don’t encrypt the secret keys, they can just be read out with root access or even with the use of ADB (the pull command), not even speaking about reading the memory contents while booted to a recovery.
Some even uploads the keys to a cloud service for convenience, and they consider it a feature.
Sounds more like a bad design than purposefully left backdoors. Very few devices are rooted and usually you cannot get root without fully wiping your device in process. As for cloud upload, that indeed is convenient for most regular users. I prefer encrypted offline backup like Aegis does, but you need to think about regular folk if they would loose or wipe their device.
It’s not bad design, it’s definitely intentional, however I agree that it’s probably not for having backdoors, but for convenience. Average people forget their passwords all the time, and with encryption that level of carelessness is fatal to your data if they have not saved it somewhere, which they probably didn’t do.
Very few devices are rooted and usually you cannot get root without fully wiping your device in process.
I’m pretty sure the system is not flawless. Probably it’s harder to find an exploit in the OS than it was years ago, but I would be surprised if it would be really rare. Also, I think a considerable amount of people use the cheapest phones of no name brands (even if not in your country), or even just tablets that haven’t received updates for years and are slow but “good for use at home”. I have one at home that I rarely use. Bootloader cannot be unlocked, but there’s a couple of exploits available for one off commands and such.
Q: I got a prompt asking me to grant permission for the app to access my location. Why am I seeing this?
A: You will see a prompt from the Authenticator app asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources. You’ll need to share your location once every hour to ensure you are still within a country where you are allowed to access the resource.
And? I don’t give a shit what the admins of my network want. It’s DFA – they don’t deserve to know that. Ergo, I don’t use the MS app. They can kiss my ass and fire me if they don’t trust where I am.
It’s a security / compliance policy. There is a very high chance your company has not even enabled it, have not seen anyone using it.
As I see it, you would and could use it only if you force MS Authenticator notification as the only MFA method and it is important in which country MFA prompt originates. Usually it is IP based block / whitelist which checks IP from which login originates which seems like a much more useful info, then you can also allow any MFA method.
Your question was why GPS permission is needed, you should now know why.
I am using MS Authenticator and Aegis. Using MS authenticator only for work accounts that have been setup for number matching feature, it is pretty nice to simply enter 2 digits in app than entering 6 digits in client itself any time you need to approve MFA.
Everything else that supports standard TOTP whether work related or personal is on Aegis - it is a much better TOTP app.
Setting restrictions on what 2FA/authenticators we can use. I imagine it’s only a matter of time before Google functionally makes it so you can only use theirs when using their services.
Edit: I assumed it was some of the messages I’ve seen elsewhere, my mistake. I don’t need everybody repeating the same comment. Please read the responses before telling me the exact same thing over and over again guys lol
I’ve gone tons of places that say use Google Authenticator (only) and I just summon the QR code and scan with Aegis anyway and it always works fine. I’ve never seen a place that required a certain one.
At least for what I just posted this isn’t a restriction. Its a recommendation. You can still use any other app. I thought its nice that they recommend the privacy friendly ones.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
2fas
BVG is acronym for Berliner Verkehrsbetriebe, Berlin’s public transport agency.
If you get Bitwarden pro (really cheap), you can save an OTP link together with the site credentials, it’s really good for keeping everything in one place
Proton pass can also do this
If you get Vaultwarden, absolutely free, you don’t have to pay and have full control over your data. It’s a win-win!
I do this. I want to point out it is absolutely TERRIBLE for security. It’s turning 2 factor back into 1 factor authentication.
yeah, while I understand that, it’s not every time I have both my phone and computer together at the same time
using a standalone OTP on either one of them would make the opposite a pain in the ass to use
I take a lot of precautions with my main vault password, even got a biometric reader so I don’t have to type the password that much
You’re absolutely right. It’s all about your threat model, how much convenience you’re willing to lose and what not.
I absolutely should do more to minimize potential risk, but it’s really so convenient to just… Have it all in 1 place…
Something that I do to make sure I’m more protected is that I don’t put the two-factor for my main email accounts into Bitwarden.
This is a smart solution. Only solution I have so far is self hosting bitwarden, using unique password to login, and having 2fa to login to bitwarden, where the key is in bitwarden, and on aegis on a phone at home.
I would argue its more like a 1.5 factor. Not secure when your bitwarden gets compromised. But more security for stolen, leaked, phised passwords.
I currently have 60 OTPs in Bitwarden, I probably would not have activated 2FA on so many sites without BW.
Consider your threat model. You could use a yubikey for Bitwarden log in.
This isn’t really a good idea because then you’re putting all your eggs in one basket. The whole point of 2FA is that the second factor is in a separate location so if your first factor (password) gets compromised the second one (OTP code) still protects your account. If both factors are in one place you’re back to a single point of failure instead of 2, losing a key benefit of 2FA.
If you’re gonna do this, at the very least have 2FA with a security key on your bitwarden vault.
You lose security, sure. But you are gaining so much more ease of use. Bitwarden autofills your credentials and puts your token into your clipboard. Also it syncs your tokens to all devices. Effectifly this makes a site as easy to login as a site without 2fa.
The alternative is on desktop always get your smartphone, open some app type a token or on the phone to switch to multiple apps to get your credentials. Not fun imho.
I currently activated 2fa on over 60 sites, I doubt I would use it as much without BW.
For me, the key benefit of 2Fa is getting more security against leaked, stolen, phished passwords, and that still holds up.
There are desktop apps for OTP, you don’t need a phone. And since you only need to setup an OTP secret once, doing it for your phone and pc isn’t that big of a deal.
I have my OTP secrets in 3 places, 2 yubikeys and my phone’s authenticator app, with the former meant for my PC.
If your vault doesn’t have 2FA too this doesn’t hold up though. Means you’re trusting a single service that can get hacked with all your secrets. Sure, your other accounts are more protected against leaks and stuff, but if your password vault isn’t, you didn’t really change much, just pointed the hackers to one single place.
Yes I know hacking a password vault isn’t some walk in the park and rarely happens, but the point is any leaks from it would be 10 times more catastrophic for you if all your OTP secrets are also stored in it. I’ll spare myself from that nightmare with the small inconvenience that is a separate, offline OTP app.
Good points!
I got the vault protected via yubikey of course ;)
FreeOTP+ is the choice not Free OTP…
I self host Bitwarden (Vaultwarden) so I just use the built-in TOTP authenticator in the Bitwarden app. It’s nice to have it all in one place + having auto copy and paste when I log in. And because I self host, it’s all backed up securely and with (as far as I know) no real backdoors.
ETA: just realized what community this is in. people that replied to me I’m sorry lmao, I’m not a nut about this kinda stuff and I’m by no means recommending this just like using it this way for convenience factor and to keep the likes of google out of my password.
I do the same thing. And Bitwarden’s 2FA is off my phone. In a complicated world, it’s reasonable to keep 1 password + 2FA as secure as possible. I simply can’t handle the hassle of pulling out my phone for every 2FA login, but still value the protection 2FA + randomly generated passwords provide.
No, please do not do this. Two factor authentication should be just that: two separate factors of authenticating yourself. Having them combined in one is the same as one factor.
Said in the reply to the other comment here, but I don’t really self host for security/privacy sake. And in addition to that comment I’d also like to say that I do use a YubiKey when possible for MFA. I’m not a security nut enough to care about TOTP (which kinda sucks anyway) all too much but for important things I do use physical MFA.
U2F on Bitwarden, in principle, doesn’t guard against attackers breaching into your accounts, as the Yubikey serves as a second factor during the authentication stage when the Bitwarden app retrieves the encrypted vault. Unless you combine a static secret from the Yubikey into the master password of the vault, an attacker could, in theory, steal your encrypted vault from the central Bit/Vaultwarden server or any device that’s already downloaded it (note that if this device is your phone, all conventional TOTP is thwarted anyways, so in general phones are the most lucrative target here.) From there, the strength of your master password becomes the only thing separating an attacker from access to all of your online accounts.
I’m not saying that it’s a bad practice and you absolutely shouldn’t do it — I do it myself, as I trust the security of Bitwarden’s servers and my devices in keeping my vault safe. The salient point here is the burden lies on online services upgrading their outdated security options to support U2F, not on us settling with an objectively inferior 2FA option because these services are too lazy and slow.
I have a really long password on Bitwarden like 30+. I use OnlyKey to store this password on a hardware device.
You mentioned phones. My problem with using another 2FA app is that it’s still on my phone.
Yeah it compromises the idea of a second factor. Bitwarden is the worst choice. It’s only one thing: comfortable
Fair, although I’ve said in a comment on this account somewhere else, I self host more for convenience sake than anything. I just like having my own password manager, sure it’s not as secure to use it for MFA but it’s better than giving my passwords to Google, LastPass, etc. and then using eg Google Authenticator. Self hosting is more a corporate distrust thing than a privacy thing for me
Is there something wrong with 2FAS?
i think they got some google trackers in their code
I’d love to know as well.
Been using it for a while as the 2FA app used and recommended by Leo Laporte. I’ve had a good experience with it, but if it has any issues, I would love to know.
Edit: A while being a year or two.
From what I can tell, 2FAS basically comes with the reasons people want Authy, with only some of the downsides. Cloud sync between devices is neat, but it adds a potential vector for attack (which is just inherent to the process).
I went for another foss one a while ago, works flawlessly https://authenticatorpro.jmh.me/
That’s the one i use too, really a nice app
that’s a refreshing change from the regular Google Authenticator and Authy mentions.
What’s wrong with Authy?
Apparently it is hard to export out of authy
Here is their justification:
https://support.authy.com/hc/en-us/articles/1260805179070-Export-or-Import-Tokens-in-the-Authy-app
Microsoft authenticator has joined the chat
Good to know, thank you.
Since it’s nice and easy to move to any device, I hadn’t really noticed that yet. I dislike when people put sneaky walls up to keep me from my own data
Nothing
According to Wikipedia it’s based on google authenticator. Is it known how much google code is still in there?
FreeOTP is what you’re talking about, right? It’s “Maintained by RedHat, and based on Google Authenticator.” So it’s under the control of a major open source group. I wouldn’t be worried. It’s not like or Firefox, where fork developers have to play catch-up.
only what I don’t like in FreeOTP is lack of passcode or biometrics
I use FreeOTP+ and it requires biometrics to open
Incredibly based.
Come to think of it, it’s sad how we’ve got so accustomed to be suggested Google Authenticator and the other big corp data funnel 2FA apps by the services that support it
andOTP is opensource, backs up locally, remotely, encrypted, or unencrypted. has no back doors, and will work with any DFA i can chuck at it.
its an archived project but still works fine in modern android
https://github.com/andOTP/andOTP
why not 2fas
Why not Aegis?
Are there well known TOTP apps with backdoors?
That depends. More of the popular ones don’t encrypt the secret keys, they can just be read out with root access or even with the use of ADB (the pull command), not even speaking about reading the memory contents while booted to a recovery.
Some even uploads the keys to a cloud service for convenience, and they consider it a feature.
Sounds more like a bad design than purposefully left backdoors. Very few devices are rooted and usually you cannot get root without fully wiping your device in process. As for cloud upload, that indeed is convenient for most regular users. I prefer encrypted offline backup like Aegis does, but you need to think about regular folk if they would loose or wipe their device.
It’s not bad design, it’s definitely intentional, however I agree that it’s probably not for having backdoors, but for convenience. Average people forget their passwords all the time, and with encryption that level of carelessness is fatal to your data if they have not saved it somewhere, which they probably didn’t do.
I’m pretty sure the system is not flawless. Probably it’s harder to find an exploit in the OS than it was years ago, but I would be surprised if it would be really rare. Also, I think a considerable amount of people use the cheapest phones of no name brands (even if not in your country), or even just tablets that haven’t received updates for years and are slow but “good for use at home”. I have one at home that I rarely use. Bootloader cannot be unlocked, but there’s a couple of exploits available for one off commands and such.
Anything closed source could have backdoors. Trust no one.
Why does MS Authenticator need GPS permissions?
https://play.google.com/store/apps/datasafety?id=com.azure.authenticator
As per their FAQ:
And? I don’t give a shit what the admins of my network want. It’s DFA – they don’t deserve to know that. Ergo, I don’t use the MS app. They can kiss my ass and fire me if they don’t trust where I am.
It’s a security / compliance policy. There is a very high chance your company has not even enabled it, have not seen anyone using it.
As I see it, you would and could use it only if you force MS Authenticator notification as the only MFA method and it is important in which country MFA prompt originates. Usually it is IP based block / whitelist which checks IP from which login originates which seems like a much more useful info, then you can also allow any MFA method.
You can always deny permissions to apps.
You’re not convincing me.
It’s rather sick to an app that’s open source
Your question was why GPS permission is needed, you should now know why.
I am using MS Authenticator and Aegis. Using MS authenticator only for work accounts that have been setup for number matching feature, it is pretty nice to simply enter 2 digits in app than entering 6 digits in client itself any time you need to approve MFA.
Everything else that supports standard TOTP whether work related or personal is on Aegis - it is a much better TOTP app.
Here is active fork.
https://github.com/helloworld1/FreeOTPPlus
This is what I use. Also supports exporting/importing data to and from Gnome Authenticator so you have 2FA on your computer too 👍
Sick! I didn’t think to look at the forks but that’s amazing.
I think I’d rather use a solution under active development, thanks for the rec though
This is becoming a trend and I really don’t like it.
What exactly?
Setting restrictions on what 2FA/authenticators we can use. I imagine it’s only a matter of time before Google functionally makes it so you can only use theirs when using their services.
Edit: I assumed it was some of the messages I’ve seen elsewhere, my mistake. I don’t need everybody repeating the same comment. Please read the responses before telling me the exact same thing over and over again guys lol
I’ve gone tons of places that say use Google Authenticator (only) and I just summon the QR code and scan with Aegis anyway and it always works fine. I’ve never seen a place that required a certain one.
They recommend these two. Under the recommendations it even says you can also use different apps…
At least for what I just posted this isn’t a restriction. Its a recommendation. You can still use any other app. I thought its nice that they recommend the privacy friendly ones.
It literally says “Other authenticator apps that support OTP […] can also be used”.
In India, they force us to install proprietary apps, which are probably spying on us.
They don’t, though? Who’s forcing you to install a proprietary 2FA app in India. Unless you’re saying in general.
My bank, for example, does not let us use any 2FA app we want. They have their own separate app, made for handling 2FA for that specific bank only.
And in general too, yes. Like Arogya Setu. The app we had to install to prove our vaccination status.
EhrenBVG. Wie immer.