Re:Bitwarden Design Flaw
by 416chad on Monday January 23, 2023 @11:51PM
(#34499440)
As I understand it, the OTP factor only protects the login. While this is still good practice, it wouldn't help in the event the vaults are stolen.
[ Parent
| on HN ]
Yes, 2FA/MFA only serves as access control, to limit who can retrieve a copy of your encrypted vault from the server (to then decrypt locally).
Like in the Lastpass scenario, if someone gets a hold of your vault from a server side backup (or compromise), then your access control is bypassed, and won't make your vault harder to decrypt.
Using MFA is definitely good practice though, as in normal circumstances an attacker will be trying to get to your vault without server side access.