Re:Two billion email addresses were exposed
by Koffiepoeder on Thursday November 06, 2025 @06:29PM
(#45841830)
The moment you put TOTP in Bitwarden it is no longer a 'second factor'. Pretty bad security advice to be honest. Better to use hardware tokens or a secure phone (with enclave) instead (never SMS though).
[ Parent
| on HN ]
Re:Two billion email addresses were exposed
by Marsymars on Thursday November 06, 2025 @07:46PM
(#45842407)
In most cases a true second factor isn't really what any involved party cares about.
My bank (I mean, they use SMS, but pretend they use TOTP) just care about not having to spend money on support because I used "password1!" as my password for every account and lose all my money.
I just want to log in to my bank.
If I've got a long, random, unique, securely-stored password, I don't actually care about having a second factor, I'm just enabling TOTP so that I don't have to copy/paste codes from my email or phone.
Re:Two billion email addresses were exposed
by ratherbefuddled on Friday November 07, 2025 @03:42AM
(#45844627)
> If I've got a long, random, unique, securely-stored password, I don't actually care about having a second factor
I'm not comfortable with my entire online identity being protected by a single line of defence which is a company that I'm paying a few dollars a month to. Not having to type 6 digits off a phone is a pretty minor convenience for me.