Hacker News Reader

Comment by Spivak | Hacker News Reader

Bitwarden is a pretty good solution for this! It's not the smoothest since the browser extensions don't know how to fill in your codes like they do your password but it's leaps and bounds above the UX for Google Authenticator.

Being able to access my codes from any device with a web browser is very nice.

INB4:

"But this reduces your security."

* Yes, but I'm already using a password manager with 64 char generated passwords on every site.

* If you're able to compromise my Bitwarden password you likely have enough to remove the 2FA on all of my accounts anyway.

"Why even have 2FA at that point then?"

* Because some things in my life require it.

View on HN

I've found the Bitwarden browser extension has an option to automatically copy the 6 digit code after the username+password autofill. Can't remember if it does it by default though. See:

Settings / Options / Disable Automatic TOTP Copy

Thanks for posting this. The threat modeling in this thread feels very much out of wack with my personal experience. The thing that has lead to the most compromised accounts for myself is old, short, unchanged passwords on accounts I had forgotten that probably have been leaked.

Also if your local machine is compromised, which is much more common than people brute-forcing passwords, somebody can get your password and a 2FA code and access any account.

Another shout out for bitwarden. Being open source, you can self host, and it has become a semi-standard of sorts, with alternative implementations.

As a sibling mentions, when you fill inn the user/pw of an account with 2fa enabled, the 2fa pin should be copied into the clipboard by default. (so the flow is: autofill username/password; submit, paste pin;submit).

Still think it's silly there's no simple way to get an encrypted backup of the 2fa-secrets from Google authenticator - it leaves the user and an attacker (with effective root on the phone) on uneven ground. For the user the app pretends that there is no shared secret with the server that could be compromised - the attacker simply access the sqlite db.

I just paid for my second year of Bitwarden. I love it.

Reply on news.ycombinator.com