andreluis034

Wouldn't unlocking the bootloader and installing a custom ROM be easier, more stable and cheaper than buying a niche product that's unlikely to work properly?

What exactly are you looking for? Android IS Linux, do you want to try a different "distribution" just for fun?

The code is still accessible, you just can't use the code search function in the web, which normal git doesn't have anyway.

I guess that noble education is finally paying off, sort of... The only other noble one we know that wants to take another duchy is Georgine 🙃

I gotta admit, it's kinda funny how Rozenmyne perceived Ferdinand's Last Will as, "I MUST GO SAVE HIM," while the letter he sent through Justus was basically the opposite, "DON'T DO ANYTHING, YOU FOOL".

The latest pixel devices (since 6 I think?) already provide accees to a /dev/kvm device, so maybe you could even run a normal Ubuntu server VM on your phone for hosting these services.

Are you sure the content is gone? I assume the communities had users from other servers, if so isn't the content replicated on other servers?

I guess he means that raspberry pi doesn't run a mainline kernel

I'm probably obsessing over nothing, but the illustration showing Tuuli's reaction when her sister said "Tuuli... No matter what happens, I will protect you." was so good! This will probably sound pretty stupid, only now that we had this illustration did I realise how much Rozemyne grew, I was quite shocked.

Arguably, if you use 2FA to access your passwords in 1password, there’s little difference between storing all your other OTPs in 1password or a separate OTP app. In both cases, since both your secret passwords and OTPs are on the same device (your phone), you lack a true second factor. The most likely way someone would gain access to 1password secured with 2FA is if they control your device and it’s been compromised, and having your OTPs separated wouldn’t provide additional protection there. Thankfully, the larger benefit of OTPs for most people is that they are one-time-use, not that they originate from a second factor.

As you said if you have both the password manager and the OTP manager in the same device it goes against the concept of 2FA, and you can throw most of guarantees out the window.

I think one distinction worth making is that the encrypted vault itself is still only protected by one factor, the password. The OTP 1Password asks you is part of their service authentication mechanism. If for some reason the attacker manages to get an encrypted copy of your vault (Via App cache, Browser add-on cache, mitm, 1Password's servers, etc...), "all" the attacker needs is to brute force your password and they can access the contents (Password and OTP seeds) of the vault without requiring the TOPT token. Yes you can mitigate this with a good password/passphrase, but as GPUs/CPUs get faster will that password continue to be good enough in few years time? If your master password becomes "easily" brute forceable, now the attacker has access to all of your accounts because you had the password and OTP seeds in one vault.

If you truly feel you need a second factor though, you’ll probably want to look at something like a Yubikey or Titan. I’ve considered getting one to secure my 1password vault to reduce the risk of a lost phone compromising my vault.

I have one, but unfortunately the amount of services that support U2F as a 2FA mechanism is relatively small and if you want to talk about FIDO2 passwordless authentication even less.

That's a fair point. I just wanted to highlight that there may be cases where a password manager isn't automatically protected by 2FA by the two factors you mentioned (The password you know and the copy of the vault) since in the case of bitwarden fulfilling one can give you the second. In order to actually achieve 2FA in this case, you would need to enable OTPs.