Hacker News Reader

Just use Bitwarden. The UI is clunkier, but the UX is better. After it fills in the username and password, it puts the OTP in the clipboard, so you can just paste and go without opening an app and manually copying it into the login form.

View on HN

I'm hard opposed to storing my second factor codes alongside my first factors. Part of the reason why I use 2FA is because if my password store is compromised, the accounts in it that are compromised do not contain all of the credentials necessary to log into the accounts protected by 2FA. I also do not store my emergency removal codes in the same secret store as my passwords for this reason.

Using a password manager as your authenticator seems very risky to me.

You should use separate services.

If your password manager is breached, at least the infiltrator cannot pass 2FA.

It is no different from Passkeys in that regard, yet we're fine with that. If you want extra security, you would have your password manager and your OTP generator on different devices, but only a small fraction of people do that. Storing your OTP generator secrets and your passwords in the same app provides a reasonable trade-off between security and convenience for most people.

Let me add: for services like GitHub that never log you out, 2FA is pure security theater. The only factor in this case is a browser cookie.

Reply on news.ycombinator.com