The OTP you want to use was already used - eviltoast
  • jpj007@kbin.social
    link
    fedilink
    arrow-up
    4
    ·
    1 year ago

    Assuming the victim does not use 2FA on their Bitwarden account

    A pretty tall assumption given that we’re already talking about someone who knows to turn on 2FA for other things. If someone knows about 2FA and password managers, they’d be insane not to have 2FA set up on the password manager itself.

    • andreluis034@lm.put.tf
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      1 year ago

      That’s a fair point. I just wanted to highlight that there may be cases where a password manager isn’t automatically protected by 2FA by the two factors you mentioned (The password you know and the copy of the vault) since in the case of bitwarden fulfilling one can give you the second. In order to actually achieve 2FA in this case, you would need to enable OTPs.

      • jpj007@kbin.social
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        Certainly fair.

        And yeah, I personally use Bitwarden with 2FA on the Bitwarden account, but don’t store any 2FA tokens in Bitwarden, handling them all separately. Don’t want all the eggs in one basket.

        Though given I have fingerprint access on phone and computer for bitwarden, i suppose that one basket is my finger. But if someone is taking my finger, I’ve got more immediate concerns than my passwords.