735
Authy got hacked, and 33 million user phone numbers were stolen
(appleinsider.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 05 Jul 2024
735 points (99.2% liked)
Technology
55919 readers
2674 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Bitwarden has 2FA built in, and you can host it yourself if you want.
I've looked into this before and unfortunately it doesn't support the SMS requirement I have in my deal-breaker scenario—do you know if this has changed and can point me to the docs regarding it?
Oops, missed that part. Not that I know of, though SMS is a terrible way to do 2FA. It annoys me so many businesses and banks use it.
I agree it's much worse than using a modern OTP app, but I need a way to access my OTP database when the only form of digital identity I have access to is my phone number.
Authy currently supports this scenario for me (with a load of checks, it doesn't happen instantly), so I would require a like for like replacement
Bitwarden has a 2FA recovery code possible so you could use a unlabeled hard copy of the code. It cycles after every use so it would get you one recovery and doesn't use SMS so it's immune to SMS shenanigans.
That's potentially a solution then, as I guess in order to buy a new phone I would need to have not lost my wallet too at least, so I guess I could keep those items together for equivalent recovery possibility
Okay that may be a goer, I'll look a bit more into it, thanks!
Do you really need that ?
Self hosting means you have outside your phone your real vault and the phone is just connecting to it to refresh its local data.
I’ve setup my vaulwarden in my local network kit’s the local bitwarden server i use), my phone, tablet or simple webbrowser can connect to it when i’m home via the classic bitwarden (with self hosting parameters).
If i travel, i have just to start my openVpn session and connect to my home but it’s only needed if I want to update something (the encrypted cache it’s enough for consulation). If I have nothing to change, no need to have a vpn. I just use the cached data.
If my phone is stolen the data are safe (cache is encrypted, source is not on the phone). I revoke the vpn access by precaution and move one. No sms scenario needed here.
You only need to have a backup phone or computer to setup your new access on the new phone.
Edit: of course my vpn connection is protected by a passphrase so nobody can connect to my home network without me around. And the bitwarden app is also protected of course.
Do you have a second factor for your VPN? Or is it literally just a passphrase and you're in? I also need a shared key to access mine, which puts new back at square one (I will not compromise on this)
I do really need what I've described because it's literally a situation I've been in.
passphrase yes. It’s a long sentence than only me know.
As i use this vpn only when travelling and the passphrase doesn’t change, i can use my phone or tablet cached data to get the passphrase if i forget it.
And once connected to my home network via my vpn, i have access to all my services (vaultwarden, jellyfin, storage, etc...). All require of course login as i’m not accessing them from my local network.
If you self host vaultwarden you won't have an SMS backup, but provided you need the code to login to something online, you can log into Vaultwarden from anywhere with an internet connection.