Bitwarden Authenticator is a standalone app that is available for everyone, even non-Bitwarden customers.
In its current release, Bitwarden Authenticator generates time-based one-time passwords (TOTP) for users who want to add an extra layer of 2FA security to their logins.
There is a comprehensive roadmap planned with additional functionality.
Available for iOS and Android
To those that are confused about this:
Bitwarden does indeed handle TOTP directly in the password manager, but only on paid accounts and only logged in.
This is a completely offline app, separate from your existing Bitwarden account, that is entirely free.
It might serve as an alternative to e.g Aegis to some.
Is there a good reason I don’t know about to prefer this over Aegis?
No, they’re both ostensibly open source and standalone. I’m an avid Bitwarden Free user, but Aegis has been my go-to for a long time.
If it’s a standalone completely offline app, like Aegis, I’m at a loss to what they could offer that is any different than what Aegis already offers.
If you look at the roadmap they have in the blogpost, they are apparently planning tighter integration with the existing bitwarden suite
…but wouldn’t that undermine the fact that it’s standalone and offline?
The idea is that it can then work both says, like https://ente.io/auth does
I don’t see why it would if it’s optional
2FA push is on the roadmap. Does aegis have that? Or am I just too dense to realise it does?
I mean, Aegis is 2FA? That’s literally all it is? It generates One Time Pad codes for various sites and apps that support authentication apps.
So, I’m not sure what you mean?
I’m not positive but I’m assuming they’re referring to a kind of MFA where the authenticating service pushes to the client you possess rather than relying on a temporal cryptographic key. I’ve got a few services which work that way
Reading these comments, it feels like Aegis became the standard without me noticing.
Reading these comments I feel like I’m completely out of the loop because I’ve never even heard of Aegis
At this moment Aegis is far superior to bitwarden auth. But it looks promising.
I really like the ability to “sideload” the icons for the codes and automatic encrypted backups to cloud storages.Not switchin’ from Aegis. No sir’ee.
I haven’t been entirely happy with Bitwarden for other reasons. You can’t self host and share with one other person without paying them $40/year. Their advertising is deceptive, because they say you can do both for free. But that one or the other, not both.
You also can’t easily share individual passkeys outside of the app. If you want to grab a passkey, you have to export your entire vault.*
It’s basically annoyance-ware.
* note that sharing passkeys is not best practice, but there are use cases.
I don’t think I realized that was a limitation because I’ve been using the Vaultwarden fork. https://github.com/dani-garcia/vaultwarden
Have you heard if VaultWarden?
Thank goodness! I can finally get the hell away from Authy!
What’s wrong with Authy?
I guess for me, it being closed-source and the fact that the Bitwarden password manager and now Bitwarden authenticator are open source. Truthfully, I just see how they handled the desktop version of their Authy software, giving no fucks if consumers wanted it or not, being a big red flag of what could come after. Having used Bitwarden for years now, and giving them $10 a year, makes me more biased and inclined to use their other software, since they’ve never let me down. :)
I use Aegis and it works well. FOSS and easy to use.
Too many things use it, if it becomes compromised that is way too broad of an attack for me to opt into
You could have before. I moved from Authy to Aegis a few months ago
with full Internet access (As shown in Aurora Store)
Thanks but I pass, I’d rather use Aegis that doesn’t need internet connection at all.
Does this save to my cloud account with them or is it only local? I got screwed over by Aegis (my fault) when I got a new phone and forgot to back up Aegis and lost a lot of my logins. Some of them I can’t get unless I call the company and verify it’s me 🤦🏽♂️
Do backups kids. :)
I actually keep an authenticator app on my desktop, so I always have two places for everything. Aegis on my phone and “Authenticator” on my Linux desktop.
Then how do you secure the backup without 2FA?
Or is it 2FA all the way down?
You could store it on an external drive. You can encrypt it with VeraCrypt as well.
Aegis encrypts it with a password, then you copy it somewhere. It’s just a set of keys and you can have as many copies as you want (I have three, one phone and two desktops).
I backup everything, but Aegis
How do I do the backup for Aegis? I looked at it and it’s set up but then at the bottom it says no backups have been made 🤔
Settings > Import/Export > Export
This dumps it to a file, then it’s on you to copy it somewhere else.
Or
Settings > Backups
I think this one is automated, but I personally don’t use it, I just back it up manually when I add something new. I keep a completely functional 2FA app on my desktop, so I always have a backup in a pinch.
Aegis does automatic backups. I guess you didn’t turn it on?
Guess I didn’t. I hate me even more now
Yubikey and yubico authenticator is king. Just need multiple keys. Stick it in a PC or tap it on your phones nfc… bam totp code pulls up.
Great. Now I have to make the effort of migrating from Authy.
Correct me if I am wrong, but the Bitwarden client itself already does this. I store several of my TOTP’s in my self hosted Vaultwarden/Bitwarden install.
And where would you store your Bitwarden login TOTP if you used their service instead of self hosting?
And what happens if your Bitwarden account gets compromised? Now you’ve lost both factors at the same time.
No, I’ll keep my 2FA separate from my password manager, thank you very much.
You’re right, it does. This is a head-scratcher.
I guess they already had the TOTP code written, so creating a standalone app was trivial, but what’s the point?
Security-wise it’s not a good idea to keep passwords and 2FA codes in the same client as it then becomes a single point of failure. A standalone authenticator app resolves that as long as it’s not unlocked with the same master password. A standalone app also opens a venue for non-BW customers to get on their platform.
Would it count if the application is the same but all the TOTP is handled by a different database with a different passphrase?
It’s not a good idea to keep both on the same device, but i wouldn’t use it at all if it was a struggle
thd totp in the default application is paid and that isn’t
TOTP in the Bitwarden Vault is a paid feature. The standalone app is free, and doesn’t even require a Bitwarden account.
This allows free tier users a way to use TOTP without upgrading, and without needing to trust Google Authenticator or something else.
After Authy scrapped its support for the desktop client, I’m looking for an alternative. Sadly, this does not look like it.
Sadly, this does not look like it.
Why?
I do not see a desktop client.
Ah. I only use a phone app, but I see the problem.
Ente.io is working on a desktop app. Whilst its experimental, you can get it from the releases page on their github
I use Authenticator on Linux. I’m not sure what OS you use, but perhaps there’s another, TOTP is a pretty easy protocol to implement (it’s basically just a hash of a key and timestamp).
OK, so one TOTP app more. What’s this one doing better than all the others like 2FAS?
one TOTP app more
You say this as a bad thing.
Yeah, they’re are a few open source TOTP apps that seem pretty interchangeable. I use Authenticator Pro because it has a Wear OS integration that is handy if you have a smart watch.
For now: Nothing. Pretty bare metal atm.
deleted by creator
KeePassXC can do this as well. I had no idea until I saw a post on here where someone mentioned it. Here’s the documentation.
Good. They make great stuff.
Nice! I currently have a couple of services on MS Authenticator that I can migrate over.
What makes you switch to this one rather than staying on MS?
MS not trustworthy
Honestly? This.
The less I have to rely on Microsoft or googie for anything, the better.
Why not just use Strongbox? All of that’s built in and don’t have to store your vault on their cloud.
This new app is offline.
? Works fine for me and their site seems to be normal as well:
No I mean the new bitwarden app works completely offline lol
Oh - haha. My bad I misunderstood.
Strongbox is, too?
Didn’t say it wasn’t, however you said that this new app was tied to online sync, which it is not.
Jesus fuck. How many more authentication apps do we need that all do the same thing?
At work I need at least 4-5 different authentication apps because every customer has something different.
We don’t need another.
Random number generator 2fa?
