It was one of the easiest to setup and it works flawlessly. I’m a bit paranoid about losing my data even with the backups… Any recommendation?

  • balance_sheet@lemmy.worldOP
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago

    TOTP function is what really made it happen. It brings me so much joy to have one, self hosted service to do everything login related compared to using Authy too. I was way too invested in Authy which was never comfortable for me. I now found peace.

    • cyanide@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      Is having your passwords and TOTP in one place recommended? I would’ve thought that having both separate would be more secure.

      • Widget@kbin.social
        link
        fedilink
        arrow-up
        4
        ·
        1 year ago

        It still defends against one failure mode (the website gets hacked but you’re ok) but yeah, obviously if you get hacked and the hacker knows how to get your vault out then you’re 100% screwed.

        My suggestion is always hardware 2FA, even though it’s not as mature as the other systems. Personally I have two Yubikeys (in case one breaks/gets lost) but it does mean that I need to add TOTPs to both of them each time I add a new 2FA.

        • boothin@kbin.social
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          I’m fairly certain hardware based 2fa has been around since the early 90s maybe even earlier. It’s not the maturity that’s the issue, as I’m fairly certain its significantly older than application based, but that it’s extremely inconvenient for the user to have to buy a physical key and keep it safe

          • Widget@kbin.social
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            I don’t mean that it’s not old, I mean that it’s still got some more room for improvement. Passkeys, for instance, are an attempt at improving the user experience.

      • astrsk@kbin.social
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        It is discouraged but with a very strong non-reused primary password for your home instance, you’d be hard pressed to have problems with hackers even if they dump your database. It’s still a better idea to use a hardware key but that’s understandably annoying to carry/use.

        One thing you could do is setup a second vaultwarden instance running on a separate machine ideally on a separate network and keep only TOTP connections on it, with its own backups and storage. But that is probably just as annoying.

        • dan@upvote.au
          link
          fedilink
          arrow-up
          1
          ·
          edit-2
          1 year ago

          It’s still a better idea to use a hardware key

          I’m looking forward to more sites supporting Webauthn / FIDO2 one day. Many companies are moving this way for internal systems, since TOTP is vulnerable to social engineering attacks (eg an attacker calls and says they’re from IT support and need a TOTP code for security purposes).

          You don’t always need a hardware key though, I don’t think. At my workplace we use Yubikeys with a certificate stored on them, but on my phone (Galaxy S22) I can use my fingerprint to authenticate. I don’t know a lot about it.

      • balance_sheet@lemmy.worldOP
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        That definitely is my concern but I think as long as I keep my master pw safe, which is ridiculously long, I’ll be fine. I don’t use my master pw anywhere else.