Re:Ente: Open-Source, E2E Encrypted, Google Photos Alternative
by vishnumohandas on Saturday March 02, 2024 @12:47PM
(#39574223)
The primary issue with Bitwarden is that your passwords and 2FA tokens are stored at the same place, essentially nullifying the second factor.
Also, the feature to store 2FA tokens is only available on Bitwarden's paid plan, while with Ente it's free.
Re:Ente: Open-Source, E2E Encrypted, Google Photos Alternative
by amarshall on Sunday March 03, 2024 @03:44PM
(#39584372)
> essentially nullifying the second factor
Not totally. It still protects from the password being disclosed via other means (e.g. server db leak).
Re:Ente: Open-Source, E2E Encrypted, Google Photos Alternative
by e12e on Monday March 04, 2024 @04:39AM
(#39588591)
Well, no - if we assume server password db leak includes leaking totp shared secret...
But that is also why I'm not overly concerned by the bitwarden model: in client compromise (ie phone), attacker gets both password and totp secret. But so too in many examples of server compromise.
Seperate totp app doesn't really mitigate any risk factors - but a seperate hw token/device do.
You could have 2fa only on phone, password manager only on desktop - but then logging in anywhere on your phone is inconvenient.
Then again: "Security is not a convenience".
About auth, I'm not sure the claim in the readme is entirely correct:
> Two years ago, while building Ente Photos, we realized that there was no open source end-to-end encrypted authenticator app.
Surely bitwarden existed and had 2fa support two years ago? Granted it's not only an authenticator app...
Ed:[I guess 2fa is/was a pay-only feature, so only source-available? ]
Looks like auth is a great dedicated 2fa app by the way, surprised I've not come across it before.