[HN Gopher] Bitwarden Authenticator
___________________________________________________________________
Bitwarden Authenticator
Author : pil0u
Score : 68 points
Date : 2025-02-23 21:11 UTC (1 hours ago)
(HTM) web link (bitwarden.com)
(TXT) w3m dump (bitwarden.com)
| sepositus wrote:
| > In this initial release, your data will be backed up through
| the mobile operating system's backup services. Please make sure
| your device is turned on and configured for backups. Bitwarden
| Authenticator data is included in the OS backups and will be
| restored with them.
|
| At least it's not defaulting to their own cloud service backend.
| This has always been my problem with these types of apps.
| Although, I'm not sure I fully understand the above description.
| I'm guessing if you have an iPhone with iCloud backup enabled, it
| means data is backed up to iCloud.
| hackmiester wrote:
| Or if you are using "iTunes backups" it will store them in
| there as well.
| stwrzn wrote:
| > New features on the roadmap include import, syncing to
| Bitwarden accounts, push-based 2FA, and account recovery.
|
| When syncing is added it would actually be something to
| consider.
| fn-mote wrote:
| Are your cloud backups encrypted? Yes, but the key is backed up
| too. [1]
|
| The regular complaints here about iMessage not having good E2EE
| is a specific exception written into the security policy.
|
| Corrections welcome.
|
| [1]: https://support.apple.com/guide/security/security-of-
| icloud-...
| janalsncm wrote:
| It really depends what your threat model is. If you are
| concerned about government intervention a TOTP isn't going to
| stop them.
| procaryote wrote:
| Kinda worrying that it doesn't mention anything about how that
| is secured.
|
| Google Authenticator had the fun idea to opt people into
| unencrypted (beyond whatever regular google drive files have)
| cloud backup of 2fa secrets, and it's been exploited in the
| ways you'd expect.
| izacus wrote:
| Both mobile operating systems use e2e encryption for the
| backups.
| wongarsu wrote:
| On my Android, what's the upside of using this instead of
| Google Authenticator if they both back up to the same place?
|
| If they used their own cloud backend I would be a lot more
| interested. They could even offer to store it in their cloud
| end-to-end encrypted (making it my responsibility to keep the
| password safe). That would give me similar exposure as their
| password manager, which I'm already using.
| NewJazz wrote:
| How would this work on a degoogled android? I just use freeotp+
| and have backup codes in case I lose the device.
| ThePowerOfFuet wrote:
| Use Bitwarden with a Pro subscription ($10/year).
| stwrzn wrote:
| Or host self-host the server
| rowlandc wrote:
| Vault warden is much easier to self host and does all the
| same things, without the need for a premium subscription
| too.
| cyberge99 wrote:
| Why are people so adverse to having premium accounts if
| it's reasonably priced and provides value?
| elashri wrote:
| You can pay customary $10 per year to bitwarden to
| support and still selfhost valultwarden. Some people want
| to have control and don't want to have to deal with VC
| money getting in the way (1password was a hard learnt
| lesson). Also vaultwarden seems lot cleaner and easier to
| install and manage than official bitwarden server. And
| you still rely on their clients.
| Uvix wrote:
| Vaultwarden _used_ to be a lot easier to install, but the
| official server also has a single-container option now:
| https://bitwarden.com/help/install-and-deploy-unified-
| beta/
|
| It's technically in public beta still, but I've been
| using it for a year and a half without any issues.
| therealpygon wrote:
| One option would be Vaultwarden server for your password
| storage (Bitwarden compatible) and 2FAS for auth (export once a
| week and save the backup to your own cloud)
| makeitdouble wrote:
| Is it standard for Bitwarden to have absolutely no mention of a
| any plan to also build a PC app ?
|
| I can't find any.
| sigmoid10 wrote:
| Bitwarden does come with an app for every major operating
| system. Or do you mean this authenticator app? It kind of goes
| against the idea to have this anywhere but your phone.
| serial_dev wrote:
| I don't see why an authenticator app could not be used from
| desktop or web.
| saghm wrote:
| Does it? I thought the whole point was to require something
| that's not stored right next to the password in the database,
| making it more resilient to leaks/hacks/incorrect hashing and
| salting, etc. I don't think there's a single site where I
| have the option to "remember this device" to avoid needing to
| put in a 2FA code on every login where I haven't enabled it
| on my personal devices, and on a lot of them, I'm not even
| sure the cookies have ever expired. This seems like a case of
| https://xkcd.com/1200/, although I'll throw in my favorite
| personal example because of how absurd I find it: on the
| Domino's pizza Android app, it allows me to open it after
| months without using it and order food charged to my credit
| card without needing to reenter my password, but if I want to
| save something new as my "Easy Order" to avoid having to
| manually put everything into the cart and then hit
| "checkout", I have to put my password in again for that!
|
| I've been lazily (in the "lazy evaluation" sense, not the
| work ethic sense) moving my 2FA from a mobile app into
| Bitwarden precisely because it's way more annoying to have to
| take my phone out and manually enter a code from there v when
| logging into things (especially since lately I've noticed
| that I seem to get errors when the code still has a few
| seconds left in the UI as being valid after I've already
| gotten the response from the server not accepting it; I
| asumed that this might be due to some issue with my phone
| itself, but the fact that it still happens with the codes
| being stored in Bitwarden and visible on the same screen
| where I'm logging into makes me wonder if this is some new
| intentional thing sites are doing intentionally without
| regard to how weird an experience this will be for some
| people).
| Paul-Craft wrote:
| Just use your Commodore 64 instead:
| https://www.gadgetany.com/news/now-the-commodore-64-is-a-two...
| stavros wrote:
| I'm confused, doesn't BitWarden already include this
| functionality? I've been using it for years, have they split it
| out into a separate app?
|
| I tend to use Aegis for the two services' TOTP codes that I don't
| put into BitWarden.
| twoparachute45 wrote:
| The built-in TOTP in Bitwarden password manager is only
| available to premium Bitwarden subscribers, requires you to
| have a Bitwarden account, and stores your TOTP codes in
| Bitwarden's servers.
|
| This standalone app is available for free, can be used without
| an account, and the TOTP codes are only stored locally (or
| through your phone's native backup system).
|
| Some people dislike the idea of storing TOTP codes in the same
| location as passwords, so it seems this helps provide those
| people with that separation, while still using Bitwarden
| products (which tbh is cool with me - a lot of the other TOTP
| apps on the appstores suck).
| stavros wrote:
| That makes sense, thank you!
| elashri wrote:
| > Some people dislike the idea of storing TOTP codes in the
| same location as passwords,
|
| And many organizations/companies have policy against that
| although I don't know how can anyone enforce that.
| nyolfen wrote:
| > The built-in TOTP in Bitwarden password manager is only
| available to premium Bitwarden subscribers, requires you to
| have a Bitwarden account, and stores your TOTP codes in
| Bitwarden's servers.
|
| if you selfhost (eg with vaultwarden) you get all the pay
| features for free
| pooriamokhtari wrote:
| Having TOTP tokens stored alongside passwords kind of defeats
| the purpose of two-factor-authentication. I think this alone
| justifies development of a separate app, but there must be
| other reasons as well.
| znkynz wrote:
| Deffo a tradeoff. But then my bitwarden account is secured
| with a long phasephrase, and MFA (with offline recovery
| codes), with the TOTP in Google Authenticator. Its a
| tradeoff, but on balance, i am happy to keep my TOTP for
| accounts secured by bitwarden inside bitwarden.
| layer8 wrote:
| It doesn't support syncing between devices.
|
| An alternative is Ente Auth:
| https://news.ycombinator.com/item?id=40883839
| satvikpendem wrote:
| I use this, it works great for when you're on a laptop and
| can't be bothered to pull out your phone to enter the 2FA code
| (because it works cross-platform on web, desktop, and mobile,
| all syncing together). Yes, technically this is a corruption of
| the principles of why you'd need 2FA in the first place, as the
| second factor is obviated when everything is on one device, but
| I find the risk acceptable, no one is going to hack into my
| laptop at home, and if they do, I have bigger things to worry
| about than 2FA.
| magixx wrote:
| Can you elaborate? The android app, browser extension, and
| desktop app all keep in sync for me.
| riffraff wrote:
| Are you talking of bit warden password manager or bitwarden
| authenticator? The latter does not seem to have a desktop
| version.
| yoyohello13 wrote:
| So I've been a happy Bitwarden subscriber since about 2020. I
| originally picked it because it seemed like a good compromise
| between open source options like keepassxc and something less
| trustworthy like one password.
|
| I haven't really be paying much attention to Bitwarden lately,
| but I've heard they've taken vc/got bought out or something. So
| for those more in the know, is it time to start migrating? Or
| does Bitwarden still seem like it's on a good path?
| aetherspawn wrote:
| Why do you say 1Password isn't trustworthy? We've been using 1P
| close to a decade and they've managed to not leak our passwords
| that whole time, unlike many other cloud password managers who
| have had breaches.
| yoyohello13 wrote:
| Sorry, I didn't mean to specifically call out 1password. I
| should have said "closed source" not "untrustworthy". Last
| time I looked at password managers Bitwarden and keepass were
| the only real oss solutions. And Bitwarden had better qualify
| of life features.
| marcosscriven wrote:
| How does this compare to Authy? I use Bitwarden and have been
| very frustrated with their UI changes.
| kwanbix wrote:
| Yeah, their UI is getting worst. Now some genius decided that
| the default if you touch a login, is to edit, not to fill the
| form.
| tecleandor wrote:
| Yeah! I hated that! Thankfully I found that you can change
| that behavior in a preference.
| deanmoriarty wrote:
| I prefer the new default behavior, filling the form for my
| use cases never happens through the vault view, it's always
| done via keyboard shortcut or autofill suggestion icon. I use
| the vault view to look at additional notes like secret
| questions/etc, so I'm glad it works that way.
| locusofself wrote:
| I hate this too
| dankwizard wrote:
| Do a few searches of "Authy" and you'll be switching sooner
| rather than later. Absolutely awful app.
| mdevere wrote:
| Big fan of Bitwarden, albeit you are putting a single point of
| failure on all of your secure info.
|
| I'd love to know what others do to maximise both convenience and
| security.
|
| For two-factor authentication, I wouldn't use the same service
| for both layers. Seems daft to use Bitwarden as both the password
| keeper and the TOTP provider. Not sure if that's a
| cryptographically coherent view, but hey.
| tomasff wrote:
| Bitwarden Authenticator is a separate service. Even if you
| don't use bitwarden you can use this apparently
| ViVr wrote:
| I'd like to see them add support for including attachments in
| your Bitwarden exports before i go putting any more critical data
| into their ecosytem.
|
| It has been a feature request for close to 6 years now:
| https://community.bitwarden.com/t/allow-attachments-to-be-ex...
| jackhalford wrote:
| Personally I just backup the underlying filesystem (i.e /data)
| that vaultwarden uses.
|
| Edit: I realize you are probably using bitwarden directly, in
| which case don't you trust them to safeguard your data?
|
| ps: if it's just ssh keys, just store them as key value pairs?
| I haven't kept ssh keys for a long time thanks to tailscale
| ssh...
| ViVr wrote:
| > I realize you are probably using bitwarden directly, in
| which case don't you trust them to safeguard your data?
|
| Yes i use bitwarden directly, no self hosting. I do trust
| them keep my data safe (although i also trusted LastPass at
| some point, big mistake) but why not also keep a local copy,
| just in case. The type of data you store in bitwarden is
| worth the hassle and if Bitwarden Inc. ever gets into big
| trouble suddenly you'll be glad to have the backup.
| jackhalford wrote:
| Funny this pops up today, I've finished migrating form KeepassXC
| to a self hosted vaultwarden, the official bitwarden apps and
| briwser extension are super well made, so good so far with the
| switch.
___________________________________________________________________
(page generated 2025-02-23 23:00 UTC)