TOTP keys in Bitwarden

[leriak]

I've been using bitwarden for a while now (maybe a year?) and I just recently realized that it can store TOTP keys for 2 factor authentication.

Just curious, does anyone use this functionality?

IMO it doesn't seem very good practice to put passwords and the means to obtain 2FA codes on the same bucket...

 

[Rusty]

Just curious, does anyone use this functionality?

IMO it doesn't seem very good practice to put passwords and the means to obtain 2FA codes on the same bucket...

I use it for some services that are not critical. But in general, yes.

 

[SynoMan]

Basically I use it like that. What makes me think now...

 

[Telos]

IMO it doesn't seem very good practice to put passwords and the means to obtain 2FA codes on the same bucket...

Specifically, what is the risk vector?

 

[SynoMan]

Basically I use it like that. What makes me think now...

Ok, but I have 2FA for BW separated.

 

[leriak]

Specifically, what is the risk vector?

That if someone finds a way into your vault they will have the info necessary to log into your accounts with 2FA active, while if the TOTPs are somewhere else they won't.

So, yes, you can argue "how likely is someone accessessing your vault?" and "it's way better to have 2FA stored with the passwords than not having 2FA in the first place"... and I'd agree.
But I still think that storing passwords and TOTP together is less secure than having them separate, although it is extremely convenient.

 

[Telos]

That if someone finds a way into your vault they will have the info necessary to log into your accounts with 2FA active, while if the TOTPs are somewhere else they won't.

The vault is on my NAS. It is protected with a massively long mixed character password and a fake email of similar complexity. I also have a 2FA app on my phone, which is probably exposed to greater vulnerabilities and deceptive apps. It's likely a coin toss of which is safer. Maybe a YubiKey... but then I would have to trust its maker

But no worries... I'm protected...

 

[fredbert]

it can store TOTP

Didn't have my techie head on when I read that this morning.

TOTP - Wikipedia

en.wikipedia.org

I wondered what Top of the Pops (old UK pop music TV programme) had to do with NAS.

 

[one-eyed-king]

I protect mine with a physical yubikey: the first login requires the yubikey to be plugged in into usb or activated by NFC. The yubikey is on my keychain.

I don't see a reason to not store TOTP keys in a self hosted bitwarden/vaultwarden instance when it's protected by MFA.

 

[ilbarone87]

It works well, you can do it but it’s pointless from 2FA point of view. If you store TOTP and password in the same place you lost the security of the second factor. 2FA exist to enforce the security of the authentication adding a second mean to that process, that mean certify that you’re exactly the owner of that account that is trying to login. If you get compromised the attacker will have all the tools to access your account.

I've been using bitwarden for a while now (maybe a year?) and I just recently realized that it can store TOTP keys for 2 factor authentication.

Just curious, does anyone use this functionality?

IMO it doesn't seem very good practice to put passwords and the means to obtain 2FA codes on the same bucket...

 

[Telos]

It works well, you can do it but it’s pointless from 2FA point of view. If you store TOTP and password in the same place you lost the security of the second factor.

So if I have TOTP app on my phone, you're saying I can't store passwords on my phone? So I should carry a pocket notebook with all my passwords? What in heaven's name is one to do? Commit 24-character passwords to memory?

 

[leriak]

I protect mine with a physical yubikey: the first login requires the yubikey to be plugged in into usb or activated by NFC. The yubikey is on my keychain.

I've been meaning to get Yubikey for some time, but something in the back of my mind keeps me from buying one and I can't tell exactly why... maybe it is the little mean cheap person in me who thinks it is totally overkill for a regular user like me...

Do you use the key in every account where it can be used or just for a few ones and then TOTP? And do you use it in addition to- or instead of- TOTP?

The vault is on my NAS. It is protected with a massively long mixed character password and a fake email of similar complexity. I also have a 2FA app on my phone, which is probably exposed to greater vulnerabilities and deceptive apps. It's likely a coin toss of which is safer. Maybe a YubiKey... but then I would have to trust its maker

Yes, I agree with your point. I'm not saying that if your account is secured it is an aberration to do it, my point is just that it seems funny in my mind to store those things together.

 

[ilbarone87]

So if I have TOTP app on my phone, you're saying I can't store passwords on my phone? So I should carry a pocket notebook with all my passwords? What in heaven's name is one to do? Commit 24-character passwords to memory?

Technically that’s it. Anyway I was speaking about the condition where you store password and TOTP next to it in BW.

 

[AdrianEarnshaw]

So if I have TOTP app on my phone, you're saying I can't store passwords on my phone? So I should carry a pocket notebook with all my passwords? What in heaven's name is one to do? Commit 24-character passwords to memory?

You can do it. 1st password: 1,2,3….,23,24. See all those commas will throw anyone off