Hacker News Reader

Comment by stavros | Hacker News Reader

I'm confused, doesn't BitWarden already include this functionality? I've been using it for years, have they split it out into a separate app?

I tend to use Aegis for the two services' TOTP codes that I don't put into BitWarden.

View on HN

The built-in TOTP in Bitwarden password manager is only available to premium Bitwarden subscribers, requires you to have a Bitwarden account, and stores your TOTP codes in Bitwarden's servers.

This standalone app is available for free, can be used without an account, and the TOTP codes are only stored locally (or through your phone's native backup system).

Some people dislike the idea of storing TOTP codes in the same location as passwords, so it seems this helps provide those people with that separation, while still using Bitwarden products (which tbh is cool with me - a lot of the other TOTP apps on the appstores suck).

That makes sense, thank you!

> Some people dislike the idea of storing TOTP codes in the same location as passwords,

And many organizations/companies have policy against that although I don't know how can anyone enforce that.

> The built-in TOTP in Bitwarden password manager is only available to premium Bitwarden subscribers, requires you to have a Bitwarden account, and stores your TOTP codes in Bitwarden's servers.

if you selfhost (eg with vaultwarden) you get all the pay features for free

Vaultwarden doesn't have all the paid features.

Having TOTP tokens stored alongside passwords kind of defeats the purpose of two-factor-authentication. I think this alone justifies development of a separate app, but there must be other reasons as well.

Deffo a tradeoff. But then my bitwarden account is secured with a long phasephrase, and MFA (with offline recovery codes), with the TOTP in Google Authenticator. Its a tradeoff, but on balance, i am happy to keep my TOTP for accounts secured by bitwarden inside bitwarden.

Reply on news.ycombinator.com