Ente: Open-Source, E2E Encrypted, Google Photos Alternative

Re:Ente: Open-Source, E2E Encrypted, Google Photos Alternative by vishnumohandas on Saturday March 02, 2024 @12:47PM (#39574223)

The primary issue with Bitwarden is that your passwords and 2FA tokens are stored at the same place, essentially nullifying the second factor.

Also, the feature to store 2FA tokens is only available on Bitwarden's paid plan, while with Ente it's free.

[ Parent | on HN ]

Re:Ente: Open-Source, E2E Encrypted, Google Photos Alternative by amarshall on Sunday March 03, 2024 @03:44PM (#39584372)

> essentially nullifying the second factor

Not totally. It still protects from the password being disclosed via other means (e.g. server db leak).

[ Parent | on HN ]

Re:Ente: Open-Source, E2E Encrypted, Google Photos Alternative by e12e on Monday March 04, 2024 @04:39AM (#39588591)

Well, no - if we assume server password db leak includes leaking totp shared secret...

But that is also why I'm not overly concerned by the bitwarden model: in client compromise (ie phone), attacker gets both password and totp secret. But so too in many examples of server compromise.

Seperate totp app doesn't really mitigate any risk factors - but a seperate hw token/device do.

You could have 2fa only on phone, password manager only on desktop - but then logging in anywhere on your phone is inconvenient.

Then again: "Security is not a convenience".

[ Parent | on HN ]