Hacker News Reader

Comment by andrewzah | Hacker News Reader

You can lose the phone, just use your backup codes. Bitwarden supports otp and you can use that from any browser.

I'm a technical person and I have no idea what your post means... and I also need to figure this out and explain it to the rest of my (extended) family.

Google Accounts are the new printers, familial-y speaking.

One common 2FA method is TOTP (time-based, one time password). Bitwarden [0] is a password/secrets manager that you can host yourself. It supports TOTP so you can just use that instead of a separate app like Google Authenticator or Authy. I would not recommend this personally as if you expose your master password for bitwarden, you've also made it possible for the attacker to sign in via 2FA... which normally would require access to your phone or backup keys. But it is more convenient.

Basically, people should be using password managers by this point. I recommend bitwarden because you can host it yourself, it's good for storing other secrets, and it has browser plugins/apps.

[0]: https://bitwarden.com/

Thanks for the explanation.

Follow-up question: I downloaded Authy on my phone and my desktop, and the first thing it wants is a phone number. I'm trying to solve for not having a phone -- can Bitwarden's TOTP be used without a phone number being provided?

Thanks in advance.

Bitwarden does not require a phone, but it sadly TOTP support is only in the paid version. What I do is keep TOTP in an app called Aegis, which supports backing up the seeds. This way, I can always use the seed file to setup Aegis on a new device.

TOTP support is free if you selfhost it, e.g. with Vaultwarden [0].

0: https://github.com/dani-garcia/vaultwarden

To be fair, the paid version of Bitwarden is only 10$ per YEAR and you get lots of extra features besides TOTP support with that too:

https://bitwarden.com/pricing/

Reply on news.ycombinator.com