Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?
its best to keep passwords and totp separate
Naaah, in “Multiple factor Authentication”, the word “factor” is just to look cool… The original MfA meant “Multiple fields Authentication”. (I’ll see myself out)
i dont think i know what youre talking about?.. but factor refers to one of three types: something you know (passwords), have (totp or yubikey), or are (biometrics). having 2 passwords is almost the same as having one password, since they are the same factor. thats why having totp linked to your password manager is basically like having 2 passwords. it almost defeats the point
I made a joke, basically saying that if you use a single device, it’s “Multiple fields authentication” as opposed to “multiple factors authentication”.
ohh yeah i get it good one
Not sure I agree.
Yes, your password manager is a single point of failure this way. But I would argue any non-SMS based TOTP is better than none, so if a higher percentage of people use it the easy way instead of not at all I consider that a win.
After all, you would still not only need the password but also access to the manager which technically is more than one factor.
It’s free on KeePass, use syncthing to have personal libre cloud.
That’s just an excuse to charge more. TOTP is standardized in RFC 6238 and cost nothing to generate.
TIL password managers charge for 2FA.
- Get a free password manager.
- Get a free 2FA App. Please don’t mix passwords and 2FA so you don’t reduce it to 1FA.
For 1) I use PasswdSafe, because I can merge databases with Password Gorilla as I like.
For 2) I use Aegis. You can download an icon theme, which is quite cool.
For the 2nd point:
Mixing it doesn’t reduce it to 1fa - it still makes your accounts immune to Passwort leaks and common attacks
You are only at a 1FA level if someone hacked your PW-Manager but in that instance you’re most likely fucked anyway
Sure for the most important accounts having 2FA in another app is good so you can at least secure those if the PW-Safe leaked but I have 2FA on every single website I use(d) that offers it - even if I’m only on there once a year so using a special app is less important than just having the additional security in the first place
I use KeePassXC which doesn’t charge a cent for this.
deleted by creator
Keepassxc and macpass do it for free
If you like Bitwarden you might wanna search for a publicly hosted Vaultwarden instance that accepts user registrations. You’ll get Bitwarden with its full premium feature set.
Not 100% on board with that idea. There is no guarantee the server is not tampered. Unless you know and trust the host, Bitwarden premium is very affordable and Vaultwarden can be hosted even on free VPS. Or you can even use a KeePass fork (I’m not up to date as to what the best ones are) with any form of online sync.
KeePassXC (windows/macos/linux), KeePassDX (android) are what I use. I sync the databases between 4 devices with Syncthing.
