This is a most excellent place for technology news and articles.
To those that are confused about this:
Bitwarden does indeed handle TOTP directly in the password manager, but only on paid accounts and only logged in.
This is a completely offline app, separate from your existing Bitwarden account, that is entirely free.
It might serve as an alternative to e.g Aegis to some.
Is there a good reason I don't know about to prefer this over Aegis?
No, they're both ostensibly open source and standalone. I'm an avid Bitwarden Free user, but Aegis has been my go-to for a long time.
If it's a standalone completely offline app, like Aegis, I'm at a loss to what they could offer that is any different than what Aegis already offers.
If you look at the roadmap they have in the blogpost, they are apparently planning tighter integration with the existing bitwarden suite
...but wouldn't that undermine the fact that it's standalone and offline?
Reading these comments, it feels like Aegis became the standard without me noticing.
Reading these comments I feel like I'm completely out of the loop because I've never even heard of Aegis
It doesn't get a whole lot of attention but it's the most mature open source authenticator app and one of the first ones you would find in fdroid. With that said, there's nothing really standout about it or its features, it just works.
At this moment Aegis is far superior to bitwarden auth. But it looks promising.
I really like the ability to "sideload" the icons for the codes and automatic encrypted backups to cloud storages.
with full Internet access (As shown in Aurora Store)
Thanks but I pass, I'd rather use Aegis that doesn't need internet connection at all.
Thank goodness! I can finally get the hell away from Authy!
What's wrong with Authy?
Not open source, and I believe an account is required.
Also doesn't allow you to export so you can't switch to another service
Also they have weird behind the scenes integrations into accounts even if they are just supposed to be regular 2FA. You can read stories about Twitch not playing well with other 2FA until 30 days after you remove Authy. I don’t want those kind of shadow integrations and I should be allowed to switch apps as I see fit
And twilio, the parent company has been hacked before
I guess for me, it being closed-source and the fact that the Bitwarden password manager and now Bitwarden authenticator are open source. Truthfully, I just see how they handled the desktop version of their Authy software, giving no fucks if consumers wanted it or not, being a big red flag of what could come after. Having used Bitwarden for years now, and giving them $10 a year, makes me more biased and inclined to use their other software, since they've never let me down. :)
I use Aegis and it works well. FOSS and easy to use.
Correct me if I am wrong, but the Bitwarden client itself already does this. I store several of my TOTP's in my self hosted Vaultwarden/Bitwarden install.
And where would you store your Bitwarden login TOTP if you used their service instead of self hosting?
Glad these were answered:
Isn't this the same as storing TOTP authentication codes in Bitwarden Password Manager?
Integrated TOTP authentication is a premium feature in Bitwarden Password Manager. Bitwarden Authenticator is a standalone mobile app that generates TOTP codes for any online service that supports them. Bitwarden Authenticator can be used without a Bitwarden account.
Should I use both? When should I use the integrated authentication feature? When should I use Bitwarden Authenticator?
Integrated authentication in Bitwarden Password Manager offers a convenient way for users to add 2FA to their online accounts. This popular feature will remain available across paid plans.
Bitwarden Authenticator can be used to store your verification codes to access your Bitwarden account, as well as other online applications you use.
They can be used together, or separately, depending on your security preferences.
Great. Now I have to make the effort of migrating from Authy.
Does this save to my cloud account with them or is it only local? I got screwed over by Aegis (my fault) when I got a new phone and forgot to back up Aegis and lost a lot of my logins. Some of them I can't get unless I call the company and verify it's me 🤦🏽♂️
Do backups kids. :)
I actually keep an authenticator app on my desktop, so I always have two places for everything. Aegis on my phone and "Authenticator" on my Linux desktop.
Just like in the password manager, they ignored HOTP. Oh well.
Could you tell me more ?
HOTP is an HMAC-based OTP, whereas TOTP is a time-based OTP. Basically, this is how each works:
TOTP is quite common and honestly is all I use, whereas HOTP may be more common in certain enterprises. Main criticisms:
After Authy scrapped its support for the desktop client, I’m looking for an alternative. Sadly, this does not look like it.
Sadly, this does not look like it.
Why?
Ente.io is working on a desktop app. Whilst its experimental, you can get it from the releases page on their github
OK, so one TOTP app more. What’s this one doing better than all the others like 2FAS?
KeePassXC can do this as well. I had no idea until I saw a post on here where someone mentioned it. Here's the documentation.
Nice! I currently have a couple of services on MS Authenticator that I can migrate over.
Jesus fuck. How many more authentication apps do we need that all do the same thing?
At work I need at least 4-5 different authentication apps because every customer has something different.
We don’t need another.
You only need one app, as long as the totp is implemented in a standardized way.
4-5 TOTP apps? So far, when, e.g. Microsoft or Google have insisted use of their own Authenticator app is required, it’s worked fine for me using Ente Auth or similar just by entering the code / QR.
