Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In Bitwarden you can just store the key itself and it'll generate the codes for you, right next to your password, so convenient!


I expect the "so convenient" is sarcastic, but yes it is more convenient and also more secure.

It helps to consider the threat model. 2FA is protection against (at least) several things: brute-force password guessing, a stolen password, a hijacked email account, etc. Since password vaults like bitwarden are designed to be uncrackable on their own, the only plausible way for an attacker to compromise one is to gain control of the user's device, at which point they don't really need access to the vault because they don't just have the keys to the kingdom, they have the kingdom.

Any technology that allows users to add security to their assets while still being convenient enough to use daily, leads to greater security overall.

Personally I think we're about a decade or two overdue to switch away from passwords (as currently implemented) and towards public/private keys managed by the browser or an extension, but I don't see that happening anytime soon as it's 100% certain that if it's ever tried, each FAANG will just try to push their own system, break the whole effort with fragmentation, and everyone will still just be using passwords in frustration for the next 100 years.


What's the word, tongue in cheek? I meant it sincerely but phrased in a sarcastic tone. I unironically do this and it's saved me from two phone breakages. I cannot understand how anyone would trust any of their accounts to a single physical device that is routinely lost, stolen, or broken.

My 2FA token is just a second password that doesn't get sent over the wire directly -- it's almost like a private key where you auth via challenge... wait a minute, thought you could sneak PAKE on me?!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: