512

Bitwarden has launched a new authenticator app (bitwarden.com)

submitted 6 months ago by ForgottenFlux@lemmy.world to c/technology@lemmy.world

164 comments fedilink hide all child comments

Bitwarden Authenticator is a standalone app that is available for everyone, even non-Bitwarden customers.

In its current release, Bitwarden Authenticator generates time-based one-time passwords (TOTP) for users who want to add an extra layer of 2FA security to their logins.

There is a comprehensive roadmap planned with additional functionality.

Available for iOS and Android

top 50 comments

sorted by: hot top controversial new old

[-] cyrus@sopuli.xyz 155 points 6 months ago

To those that are confused about this:

Bitwarden does indeed handle TOTP directly in the password manager, but only on paid accounts and only logged in.

This is a completely offline app, separate from your existing Bitwarden account, that is entirely free.

It might serve as an alternative to e.g Aegis to some.

[-] revv 33 points 6 months ago

Is there a good reason I don't know about to prefer this over Aegis?

[-] SnotFlickerman 51 points 6 months ago

No, they're both ostensibly open source and standalone. I'm an avid Bitwarden Free user, but Aegis has been my go-to for a long time.

If it's a standalone completely offline app, like Aegis, I'm at a loss to what they could offer that is any different than what Aegis already offers.

[-] cyrus@sopuli.xyz 18 points 6 months ago

If you look at the roadmap they have in the blogpost, they are apparently planning tighter integration with the existing bitwarden suite

[-] SnotFlickerman 16 points 6 months ago

...but wouldn't that undermine the fact that it's standalone and offline?

[-] cyrus@sopuli.xyz 11 points 6 months ago

The idea is that it can then work both says, like https://ente.io/auth does

load more comments (2 replies)

load more comments (1 replies)

load more comments (4 replies)

[-] MiguelX413@pleroma.miguelcr.me 17 points 6 months ago

Reading these comments, it feels like Aegis became the standard without me noticing.

[-] laurelraven 21 points 6 months ago

Reading these comments I feel like I'm completely out of the loop because I've never even heard of Aegis

[-] emzili@programming.dev 8 points 6 months ago

It doesn't get a whole lot of attention but it's the most mature open source authenticator app and one of the first ones you would find in fdroid. With that said, there's nothing really standout about it or its features, it just works.

load more comments (1 replies)

load more comments (3 replies)

load more comments (9 replies)

[-] Appoxo@lemmy.dbzer0.com 11 points 6 months ago

At this moment Aegis is far superior to bitwarden auth. But it looks promising.
I really like the ability to "sideload" the icons for the codes and automatic encrypted backups to cloud storages.

load more comments (11 replies)

[-] chemicalwonka@discuss.tchncs.de 36 points 6 months ago* (last edited 6 months ago)

with full Internet access (As shown in Aurora Store)

Thanks but I pass, I'd rather use Aegis that doesn't need internet connection at all.

load more comments (3 replies)

[-] LucidNightmare@lemmy.world 25 points 6 months ago

Thank goodness! I can finally get the hell away from Authy!

[-] bamboo 9 points 6 months ago

What's wrong with Authy?

[-] bigkahuna1986@lemmy.ml 31 points 6 months ago

Not open source, and I believe an account is required.

[-] ADTJ@feddit.uk 22 points 6 months ago

Also doesn't allow you to export so you can't switch to another service

load more comments (2 replies)

[-] pineapplelover@lemm.ee 7 points 6 months ago

And twilio, the parent company has been hacked before

[-] LucidNightmare@lemmy.world 22 points 6 months ago

I guess for me, it being closed-source and the fact that the Bitwarden password manager and now Bitwarden authenticator are open source. Truthfully, I just see how they handled the desktop version of their Authy software, giving no fucks if consumers wanted it or not, being a big red flag of what could come after. Having used Bitwarden for years now, and giving them $10 a year, makes me more biased and inclined to use their other software, since they've never let me down. :)

[-] sugar_in_your_tea@sh.itjust.works 13 points 6 months ago

I use Aegis and it works well. FOSS and easy to use.

load more comments (2 replies)

[-] akilou@sh.itjust.works 7 points 6 months ago

You could have before. I moved from Authy to Aegis a few months ago

[-] Concave1142@lemmy.world 19 points 6 months ago

Correct me if I am wrong, but the Bitwarden client itself already does this. I store several of my TOTP's in my self hosted Vaultwarden/Bitwarden install.

[-] brrt@sh.itjust.works 8 points 6 months ago

And where would you store your Bitwarden login TOTP if you used their service instead of self hosting?

load more comments (3 replies)

load more comments (9 replies)

[-] capital@lemmy.world 15 points 6 months ago

Glad these were answered:

Isn't this the same as storing TOTP authentication codes in Bitwarden Password Manager?

Integrated TOTP authentication is a premium feature in Bitwarden Password Manager. Bitwarden Authenticator is a standalone mobile app that generates TOTP codes for any online service that supports them. Bitwarden Authenticator can be used without a Bitwarden account.

Should I use both? When should I use the integrated authentication feature? When should I use Bitwarden Authenticator?

Integrated authentication in Bitwarden Password Manager offers a convenient way for users to add 2FA to their online accounts. This popular feature will remain available across paid plans.

Bitwarden Authenticator can be used to store your verification codes to access your Bitwarden account, as well as other online applications you use.

They can be used together, or separately, depending on your security preferences.

[-] penquin@lemm.ee 15 points 6 months ago

Does this save to my cloud account with them or is it only local? I got screwed over by Aegis (my fault) when I got a new phone and forgot to back up Aegis and lost a lot of my logins. Some of them I can't get unless I call the company and verify it's me 🤦🏽‍♂️

[-] sugar_in_your_tea@sh.itjust.works 12 points 6 months ago

Do backups kids. :)

I actually keep an authenticator app on my desktop, so I always have two places for everything. Aegis on my phone and "Authenticator" on my Linux desktop.

load more comments (10 replies)

load more comments (7 replies)

[-] clgoh@lemmy.ca 15 points 6 months ago

Great. Now I have to make the effort of migrating from Authy.

[-] thoralf@discuss.tchncs.de 14 points 6 months ago

After Authy scrapped its support for the desktop client, I’m looking for an alternative. Sadly, this does not look like it.

[-] clgoh@lemmy.ca 9 points 6 months ago

Sadly, this does not look like it.

Why?

[-] thoralf@discuss.tchncs.de 13 points 6 months ago

I do not see a desktop client.

load more comments (1 replies)

[-] cyrus@sopuli.xyz 7 points 6 months ago

Ente.io is working on a desktop app. Whilst its experimental, you can get it from the releases page on their github

load more comments (3 replies)

[-] Coreidan@lemmy.world 13 points 6 months ago

Jesus fuck. How many more authentication apps do we need that all do the same thing?

At work I need at least 4-5 different authentication apps because every customer has something different.

We don’t need another.

[-] vividspecter@lemm.ee 28 points 6 months ago

You only need one app, as long as the totp is implemented in a standardized way.

load more comments (9 replies)

[-] dave@feddit.uk 14 points 6 months ago

4-5 TOTP apps? So far, when, e.g. Microsoft or Google have insisted use of their own Authenticator app is required, it’s worked fine for me using Ente Auth or similar just by entering the code / QR.

load more comments (2 replies)

load more comments (1 replies)

[-] rolling_resistance@lemmy.world 12 points 6 months ago

Just like in the password manager, they ignored HOTP. Oh well.

[-] UnsavoryMollusk@lemmy.world 9 points 6 months ago

Could you tell me more ?

[-] sugar_in_your_tea@sh.itjust.works 14 points 6 months ago* (last edited 6 months ago)

HOTP is an HMAC-based OTP, whereas TOTP is a time-based OTP. Basically, this is how each works:

HOTP - based on a key + a counter, which increments with each code generated
TOTP - based on a key + time, so you get a new key every N seconds

TOTP is quite common and honestly is all I use, whereas HOTP may be more common in certain enterprises. Main criticisms:

HOTP - longer time window for a key to be valid for the entire time between logins (i.e. potentially easier to brute force)
TOTP - less user-friendly due to the time window; also, you just need a clock, you don't need to know the counter value (if someone gets the key, they can generate keys whenever)

load more comments (1 replies)

[-] n0x0n@feddit.de 12 points 6 months ago

OK, so one TOTP app more. What’s this one doing better than all the others like 2FAS?

[-] pressanykeynow@lemmy.world 15 points 6 months ago

one TOTP app more

You say this as a bad thing.

load more comments (1 replies)

load more comments (3 replies)

[-] Evotech@lemmy.world 11 points 6 months ago

I'm not putting my totp with my password, same as I'm not putting my password with my email (proton)

[-] rolling_resistance@lemmy.world 9 points 6 months ago

It's a separate app with no sync to Bitwarden accounts.

load more comments (2 replies)

load more comments (4 replies)

[-] pineapplelover@lemm.ee 9 points 6 months ago

I personally have no use for this since I use Aegis and sync it with my synology drive

[-] Spendrill@lemm.ee 9 points 6 months ago

KeePassXC can do this as well. I had no idea until I saw a post on here where someone mentioned it. Here's the documentation.

[-] scytale@lemm.ee 8 points 6 months ago

Nice! I currently have a couple of services on MS Authenticator that I can migrate over.

load more comments (5 replies)

load more comments

this post was submitted on 01 May 2024

512 points (100.0% liked)

Technology

59598 readers

3027 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS