Hacker News Reader

Comment by sepositus | Hacker News Reader

> In this initial release, your data will be backed up through the mobile operating system's backup services. Please make sure your device is turned on and configured for backups. Bitwarden Authenticator data is included in the OS backups and will be restored with them.

At least it's not defaulting to their own cloud service backend. This has always been my problem with these types of apps. Although, I'm not sure I fully understand the above description. I'm guessing if you have an iPhone with iCloud backup enabled, it means data is backed up to iCloud.

View on HN

> New features on the roadmap include import, syncing to Bitwarden accounts, push-based 2FA, and account recovery.

When syncing is added it would actually be something to consider.

> [...] syncing to Bitwarden accounts [...]

In that case, what would be the advantage over just using Bitwarden's native TOTP support?

On my Android, what's the upside of using this instead of Google Authenticator if they both back up to the same place?

If they used their own cloud backend I would be a lot more interested. They could even offer to store it in their cloud end-to-end encrypted (making it my responsibility to keep the password safe). That would give me similar exposure as their password manager, which I'm already using.

Authenticators are a commodity at this point. None are special.

This just ignores important details like multi device sync, which to few support for being "commodities"

Kinda worrying that it doesn't mention anything about how that is secured.

Google Authenticator had the fun idea to opt people into unencrypted (beyond whatever regular google drive files have) cloud backup of 2fa secrets, and it's been exploited in the ways you'd expect.

Both mobile operating systems use e2e encryption for the backups.

Not in the UK for icloud

Android doesn't encrypt everything, and the details of what it does and doesn't encrypt are so fiddly that I don't feel confident enough to enable cloud backups.

Android encrypts its whole backup with E2E encryption using your PIN.

It doesn't, it encrypt some of your backup, and isn't entirely clear on which part.

No, iOS backups are not e2ee unless you go and opt-in to it, which approximately 0% have done.

Are your cloud backups encrypted? Yes, but the key is backed up too. [1]

The regular complaints here about iMessage not having good E2EE is a specific exception written into the security policy.

Corrections welcome.

[1]: https://support.apple.com/guide/security/security-of-icloud-...

It really depends what your threat model is. If you are concerned about government intervention a TOTP isn’t going to stop them.

https://support.apple.com/en-us/102651

I think this is the better link. Advanced Data Protection is end to end encrypted, without the key being backed up to Apple’s servers.

This of course only helps if ADP is available in your country and you've turned it on.

Or if you are using "iTunes backups" it will store them in there as well.

Reply on news.ycombinator.com