News for hackers. Stuff that matters.

A comment on End of Support for Firefox Lockwise. Parent comment

Re:End of Support for Firefox Lockwise by Spivak on Tuesday November 23, 2021 @03:44PM (#29323252)
Bitwarden is my goto. If you're the selfhosting type bitwarden_rs (now vaultwarden) is free and easy to setup. If not BW's cloud hosting is also fine. Vaults work offline just fine, apps on every major platform, biometric unlock if you care about such things, and autofill on browsers/ios/android. And they have a snazzy officially supported CLI tool.
[ Parent | on HN ]
Re:End of Support for Firefox Lockwise by ulimn on Tuesday November 23, 2021 @04:05PM (#29323532)
And if you pay $10/year, it has 2FA as well. And you can add notes and such. It's definitely worth using (and paying imo).
[ Parent | on HN ]
Re:End of Support for Firefox Lockwise by YXNjaGVyZWdlbgo on Tuesday November 23, 2021 @04:48PM (#29323990)
Wait so it lets you store your 2FA secrets and your password in the same place? That sounds counterintuitive.
[ Parent | on HN ]
Re:End of Support for Firefox Lockwise by jfrunyon on Tuesday November 23, 2021 @05:29PM (#29324366)
It's super useful for a few sites I visit frequently who require 2FA but I don't need that security. But yeah, otherwise it's a pretty remarkably bad idea.
[ Parent | on HN ]
Re:End of Support for Firefox Lockwise by scrollaway on Wednesday November 24, 2021 @08:26AM (#29329743)
When you sign in to a website from your phone using a saved password and use that same phone for 2fa, it's pretty much the same thing.

The whole meme that saving the 2fa seed to password managers is a bad idea needs to die. Most of the advantages of 2fa are still present when using a password manager.

[ Parent | on HN ]
Re:End of Support for Firefox Lockwise by jfrunyon on Tuesday November 30, 2021 @05:25PM (#29398270)
It's the other way around. Literally all of the advantages of using 2FA are not present when you store both factors together.
[ Parent | on HN ]
Re:End of Support for Firefox Lockwise by scrollaway on Wednesday December 01, 2021 @01:54AM (#29401384)
You are wrong. The primary advantage of 2fa is the OTP part, which wards against keyloggers and password reuse.
[ Parent | on HN ]
Re:End of Support for Firefox Lockwise by jfrunyon on Wednesday December 01, 2021 @03:53PM (#29408998)
Unless of course the keylogger also has access to the OTP.

If your device is compromised, your device is compromised.

It doesn't matter what the advantages of 2FA are. You don't have 2FA ("two-factor authentication") if your factors are stored together.

[ Parent | on HN ]