Now, looking back at the attack scenario I described above, their leaked password is not enough to log into other online accounts. > However, if they do add a 2nd factor of authentication, even if that’s a TOTP managed by the same Password Manager, they do end up in a much better place. Well, the only thing they’ve gained is a false sense of security.

And now they use the Password Manager’s web browser extension to paste the same password into each login form. > Among the people I’ve “interrogated” about sufficiently securing their online accounts were few who proudly said they’ve adopted a Password Manager and… they’ve copied their favorite password that they’ve been reusing all over the place into the Password Manager. > TOTP in Bitwarden (or 1Password or KeePass) is an upgrade over SMS authentication in terms of both security and convenience. It can store up to 32 codes, which for 99% of people is more than enough for all of their critical accounts. Which dedicated device would I recommend for storing your TOTP codes? The same one I recommend for U2F, the Yubikey 5 series (specifically the Yubikey 5C NFC). But let me propose an alternative: do that just for your most critical accounts, but use your password manager's TOTP solution for everything else. Yes, you would be more secure if you used it consistently AND had 2+ dedicated devices for your TOTP codes (your main device and at least one backup). If you secure your devices with long alphanumeric passwords, secure your password manager with U2F / WebAuthn and an even longer alphanumeric pass phrase, and consistently enable TOTP 2FA, then you'll be more secure than the person who either uses it less consistently or who uses it on device Such a user may be less likely to use 2FA in a given app because it's less convenient. If the TOTP app has backups, then it's vulnerable.ĥ. They're likely logging into accounts on their phones and have the password manager and TOTP app on their phones as well.Ĥ. Their device may not be well secured, e.g., either not requiring auth to unlock it or only having a 4 digit PIN.ģ. Without a backup, they're suddenly unable to login to their accounts.Ģ.

TOTP in Bitwarden (or 1Password or KeePass) is an upgrade over SMS authentication in terms of both security and convenience.įor most people, TOTP in a dedicated app is not actually much more secure:ġ. I keep seeing this take and it's not a great one.

Bitwarden authenticator