Open Source

823 readers

18 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Posts must be relevant to the open source ideology
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago

MODERATORS

Cloak@lemmy.ml

kevincox@lemmy.ml

CrypticCoffee@lemmy.ml

Lettuceeatlettuce@lemmy.ml

104

GitHub is slowly rolling in 2FA. Any good open source apps that will enable me to activate 2FA token on android? (szmer.info)

submitted 1 year ago by Ludrol@szmer.info to c/opensource@lemmy.ml

64 comments fedilink hide all child comments

If proprietary app is better and more robust I am willing to try it and assess it myself.

you are viewing a single comment's thread
view the rest of the comments

[–] lud@lemm.ee 2 points 1 year ago (1 children)

Kinda makes two factor authentication useless as they are both stored in the same place.

[–] GadgeteerZA 3 points 1 year ago (1 children)

I think it is more about passwords being accessible after hacks etc. What you are referring to, is if Bitwarden were to be hacked, both are accessible. Online Bitwarden has securely hashed all the data, so that is pretty useless if anyone gets it. On my devices I use biometric login, and on desktop a Yubiky as 2FA into Bitwarden. I also have it set to request login every time the browser is restarted, just in case someone were to steal the session data from the browser.

But your point is very valid if a user were to have a weak password for their Bitwarden, or not to have a good 2FA for their Bitwarden login. You want to keep that basket of eggs as safe as you can.

[–] lud@lemm.ee 1 points 1 year ago (1 children)

The whole point of 2FA is for them to be completely separate.

[–] GadgeteerZA 3 points 1 year ago (1 children)

But if the access to the combination of the two requires a separate 2FA (my Yubikey), then it is virtually separated. It is not just one password and you inside Bitwarden. One could argue otherwise, that having a 2FA app on the same phone as your password manager, is also not separate, if the same PIN/biometric gives access to that phone with the two apps on.

[–] lud@lemm.ee 2 points 1 year ago (1 children)

Do you use your Yubikey for 2FA or do you use it instead of a password?

If it's the former then I guess it's fine.

[–] GadgeteerZA 1 points 1 year ago

Yes, just for 2FA into Bitwarden's login as it's 2FA after password.