Don't store TOTP in Bitwarden for your online accounts (2022)

Re:Don't store TOTP in Bitwarden for your online accounts (2... by shortcake27 on Wednesday January 25, 2023 @03:19PM (#34523603)

> AFAIK TOTP doesn't provide protection against phishing / MITM attacks if the attacker is able to response within the time window (usually ~2x 30 seconds).

This assumes a sophisticated attack, which is absolutely possible (I’ve even seen it happen), but is less likely than a form that just captures information. In any case, in the attack you describe, storing the TOTP externally doesn’t provide any additional protection over storing it within the password manager.

> EDIT: Totally forgot - it also protects you if your password manager is breached, assuming you don't store it in the password manager

Yeah that’s the entire point of the article. But managing TOTP separately can be a bit painful. So I’m saying that if you want a bit of additional security without any inconvenience, there are still benefits to storing a TOTP in your password manager opposed to having no MFA at all.

[ Parent | on HN ]

Re:Don't store TOTP in Bitwarden for your online accounts (2... by thewataccount on Wednesday January 25, 2023 @03:24PM (#34523661)

Oh yeah totally agree with you on all of that.

I wanted to make sure the limitations were pointed out that TOTP doesn't itself protect against sophisticated MITM/phishing attacks which a lot of people I've met thought.

But it absolutely provides some level of protection against unsophisticated attacks, and it's still helpful even inside your password manager.

[ Parent | on HN ]