Bitwarden has launched a new authenticator app

No, they're both ostensibly open source and standalone. I'm an avid Bitwarden Free user, but Aegis has been my go-to for a long time.

If it's a standalone completely offline app, like Aegis, I'm at a loss to what they could offer that is any different than what Aegis already offers.

Reading these comments, it feels like Aegis became the standard without me noticing.

I used to use Aegis, but after setting up my own vaultwarden, I use the normal bitwarden app/plugin on all my systems for passwords and TOTP.

The advantages are that I don't need my phone to login, the keys are synced and backuped in the encrypted vaultwarden database, which I can then handle with normal server backup tools. It still works offline, because bitwarden app caches the password.

This is IMO much more convenient and secure (in a way that loosing access to a device doesn't shut you out, and you don't need to trust third parties) then most other solutions.

For now: No.

Do you self-host? I think that's another way to get the TOTP features w/o a paid account.

Bitwarden apps have been open source since the beginning, mobile + backend + web

I don't think I realized that was a limitation because I've been using the Vaultwarden fork. https://github.com/dani-garcia/vaultwarden

Have you heard if VaultWarden?

As others have said vaultwarden is the solution here. It is free, you can manage multiple vaults, totp is free. All the platform bit warden apps & plugins work with it. Supposedly it is leaner and easier to set up. Don't know for sure because it is all I have used.

For shared passwords, I have a family vault where I put my streaming pws and such and everyone has access without having to share my personal vault.

it's basically just a shared random number generator on a timer (it's slightly smarter than that but that's the gist), so as long as you know the start time, the current time and the starting point for the RNG, both parties can get the same result without having to ever communicate

Not open source, and I believe an account is required.

I guess for me, it being closed-source and the fact that the Bitwarden password manager and now Bitwarden authenticator are open source. Truthfully, I just see how they handled the desktop version of their Authy software, giving no fucks if consumers wanted it or not, being a big red flag of what could come after. Having used Bitwarden for years now, and giving them $10 a year, makes me more biased and inclined to use their other software, since they've never let me down. :)

I use Aegis and it works well. FOSS and easy to use.

Too many things use it, if it becomes compromised that is way too broad of an attack for me to opt into

And what happens if your Bitwarden account gets compromised? Now you've lost both factors at the same time.

No, I'll keep my 2FA separate from my password manager, thank you very much.

Security-wise it’s not a good idea to keep passwords and 2FA codes in the same client as it then becomes a single point of failure. A standalone authenticator app resolves that as long as it’s not unlocked with the same master password. A standalone app also opens a venue for non-BW customers to get on their platform.

TOTP in the Bitwarden Vault is a paid feature. The standalone app is free, and doesn’t even require a Bitwarden account.

This allows free tier users a way to use TOTP without upgrading, and without needing to trust Google Authenticator or something else.

TOTP code is like 5 lines. The hardest part is writing the seed to disk.

thd totp in the default application is paid and that isn't

Because you can enable totp on your Bitwarden account and it would be dumb to store the password and totp for your biwarden vault in your vault?

Also it can act as a stepping stone for non Bitwarden customers, before getting their own vault.

Wait, I'm a second child, am I a backup kid?

Then how do you secure the backup without 2FA?

Or is it 2FA all the way down?

I backup everything, but Aegis

How do I do the backup for Aegis? I looked at it and it's set up but then at the bottom it says no backups have been made 🤔

Guess I didn't. I hate me even more now

I do not see a desktop client.

I would like an app for desktop and phone/tablet that are syncing, just like Authy did, before they abandoned the desktop app.

So, for me that means: iOS/iPadOS and macOS

HOTP is an HMAC-based OTP, whereas TOTP is a time-based OTP. Basically, this is how each works:

• HOTP - based on a key + a counter, which increments with each code generated
• TOTP - based on a key + time, so you get a new key every N seconds

TOTP is quite common and honestly is all I use, whereas HOTP may be more common in certain enterprises. Main criticisms:

• HOTP - longer time window for a key to be valid for the entire time between logins (i.e. potentially easier to brute force)
• TOTP - less user-friendly due to the time window; also, you just need a clock, you don't need to know the counter value (if someone gets the key, they can generate keys whenever)

Not at all, I’m just wondering if this particular one is better than any of the others.

MS not trustworthy

Microsoft's Authenticator app is AWFUL. Just one example - there is a setting to backup to iCloud, but when you try to enable it, it demands you add a secondary (personal) Microsoft account.

Microsoft products would like a chat...

Yup, most 2FA is just TOTP, which is a pretty simple, open standard and is hardware independent. All you need is a key (the QR code or the numbers) and access to a reliable time source and you can make a TOTP app on anything.

I use Aegis on my phone and Authenticator on Linux (some GTK app), and they both produce identical codes for the same key.

This even works with some apps that hide the standard part - like Symantec VIP - it’s possible to extract what they are doing and use a standard TOTP app instead of VIP.

Still, I bet they share a lot of the same backend and personell.

That's also part of why I'm against the new passkeys. I think passkeys could replace either passwords or tokens, but not both.

It really depends on your threat model. It’s not a one size fits all thing.

For instance in some threat models you shouldn't have TOTP auth and passwords on the same device, let alone the same app, but the vast majority of people are not going to carry two devices because of how inconvenient it is.

It's open source. Authy isn't.

Authy killed their Windows app so its been on my mind. Im trying to use Roboform integrated mfa more, but i probably have 50 accounts in authy.

Strongbox is, too?

? Works fine for me and their site seems to be normal as well:

https://strongboxsafe.com/

True, it is a hassle sometimes... Especially on new devices.