• krimson@lemmy.world
    link
    fedilink
    English
    arrow-up
    44
    ·
    3 months ago

    Recently started using Bitwarden and it works really well. You can even ditch authenticator because it has OTP built in too.

    I selfhost it though because I trust nobody with this type of sensitive data, encrypted or not.

      • EddoWagt@feddit.nl
        link
        fedilink
        English
        arrow-up
        19
        arrow-down
        2
        ·
        3 months ago

        Not really as you’re still protected from password breaches, which is most likely to happen anyways, especially if you self host.

        If you’re actively being targeted for your bitwarden password, you likely have bigger problems

      • paholg@lemm.ee
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        2
        ·
        3 months ago

        Not if you use 2 factor to access the password manager.

          • Godnroc@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            arrow-down
            1
            ·
            3 months ago

            To set a scene, you awake in the middle of the night because your phone is making noise. Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep. The intruder now has access to your password manager!

            They attempt to log into your bank and drain your life savings, but despite having your password it sends another prompt to your phone. This time, you wake up enough to realize something is wrong. This time, you deny the prompt.

            The entire second paragraph cannot happen if your MFA is a single factor. Don’t store MFA in your password manager!

            • Hexarei@programming.dev
              link
              fedilink
              English
              arrow-up
              5
              ·
              3 months ago

              If your MFA is stored in your password manager, you’re not getting prompts to your phone about it. You’re just prompted for a otp code that you have to go out of your way to copy/paste or type in from the manager.

            • subtext@lemmy.world
              link
              fedilink
              English
              arrow-up
              4
              ·
              3 months ago

              I mean yeah it’s less secure than if they were separated. But my mom is never going to use a separate app for passwords and 2FA, so the two in one app is still better than nothing.

            • JackbyDev@programming.dev
              link
              fedilink
              English
              arrow-up
              3
              ·
              3 months ago

              Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep.

              The idea that people would approve that is wild to me.

              • Godnroc@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                3 months ago

                Mate, I’ve had users who were sharing an account that only some of them had MFA prompts for. They didn’t bother checking who had initiated the prompt, they just approved it because it was easier. And that was while they were fully awake and thinking…

                • JackbyDev@programming.dev
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  3 months ago

                  What’s funny to me is that doing this while you know your target is asleep probably has a higher success rate just because they’re more likely to press the wrong thing just because their eyes are groggy. I can read my phone without my glasses but when I wake up in the night that’s not the case right away.

            • Telorand@reddthat.com
              link
              fedilink
              English
              arrow-up
              2
              ·
              3 months ago

              Bruh, if my phone is sending me notifications in the middle of the night, the first thing I’m doing is uninstalling whatever app is sending me notifications.

              If people are that gullible to fall prey to an attack like this, managing OTP in two apps is probably more than they can handle anyway. Everybody has a different threat model, and it’s okay if it’s not covered by hardware passkeys and locally hashed and managed databases.

      • krimson@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        3 months ago

        Technically yes if my vault gets compromised I would be fucked. I have it firewalled tho and only accessible from home (or VPN to home). So should be pretty secure. I used google authenticator but found it a major pita (can’t even search entries on Android, wtf?). If they make this more user friendly I’ll gladly switch back to a seperate OTP store.

      • Allero@lemmy.today
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        3 months ago

        Yep, and Vaultwarden too!

        Though the most secure practice is to store them separately.

        • dan@upvote.au
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          The most secure practice for any high-value accounts (email etc) is to use WebAuthn with a hardware key like a Yubikey.

          TOTP is still vulnerable to phishing (a fake login page can ask for both a password and a TOTP code) so business/corporate environments are moving away from them.

          • Allero@lemmy.today
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            Sure, hardware keys are superior!

            I’m only talking about best practtices when using TOTPs in particular.

        • dan@upvote.au
          link
          fedilink
          English
          arrow-up
          3
          ·
          edit-2
          3 months ago

          The paid features aren’t free if you self-host either. You still need a premium account to use premium features with a self-hosted Bitwarden, unless you modify the code and remove the licensing checks. Licenses are pretty cheap though.

          The major features are free if you use Vaultwarden, which is an alternative server implementation.

    • WarlordSdocy@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      ·
      3 months ago

      I was thinking about self hosting but I was worried it would be less secure. I don’t really know a lot about setting that kind of thing up (I do have programming experience but don’t have a lot of server hosting experience outside of doing it for games like Minecraft) and I feel like I’d mess it up and it would be a lot easier to get into than a hardened server. Especially cause the odds I get a virus or something is probably higher then the odds someone breaks into bitwarden’s server. Idk if I’m wrong about this, would love to be corrected if I am, was just my initial thoughts when I switched over from a different password manager to bitwarden.

      • subtext@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        3 months ago

        If you don’t trust yourself 110%, don’t host it yourself. Too risky. I self-host everything, but I leave email and passwords to someone else because it’s just too important.

      • SkyeStarfall@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        2
        ·
        3 months ago

        I think the bigger thing to worry about is, what would happen if your server fails or is destroyed? Would you have a backup of all your passwords? And if yes, are those backups updated regularly and stored in a safe place that also won’t get destroyed if the server gets destroyed (like, say, a house fire)?

        Then, yes, you got the cybersecurity angle too

        It’s a lot to think about for something as important and fundamental to everything you do on the internet as passwords (and accounts)

        • Avero@feddit.org
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          backups aren’t that big of a deal with bitwarden as every client keeps a copy of the database that can be restored.

      • krimson@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        It’s pretty easy to setup using docker, you do need to know that ofcourse and how to setup dns and stuff.

        I have it firewalled so my vault is not accessible from the internet, only from home or vpn to home.

    • YTG123@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      3 months ago

      And it can also store passkeys to effortlessly sync between desktop/Android/iOS