Isn't "integrated 2fa" defeating the purpose, though?
I find the 2fa should be separate, even on a separate device, from the password store.
Which is why I never use this OTP/2FA feature in my favorite passwordmanager Bitwarden.
I find the 2fa should be separate, even on a separate device, from the password store.
Which is why I never use this OTP/2FA feature in my favorite passwordmanager Bitwarden.
If you store both the password and 2FA in something that secure, is it really causing any real harm?
If your threat model dictates that this IS a threat for you, then by all means, don't do that. But I think for the average person this is far more secure than some of the alternatives they'd be doing otherwise.
(I mean, I say this as someone who also keeps 2FA separate, but I do see some benefit to 2FA even stored with the password)
I can't take software like bitwarden seriously because they still require you to have a cloud account and/or run your own server which I also have no interest in. I want something I can actually backup natively on a client without extra effort like a script running agaisnt an api. A single file encrypted database is more than adequate. Control and ownership of the password blob is just so absolutely critical if you invest heavily in password management, especially with sites that take a stance of "password/otp or we'll never recover the account"
Worked great, until some support person on the phone actually wanted to know the answer...