- cross-posted to:
- [email protected]
- bitwarden
- [email protected]
- cross-posted to:
- [email protected]
- bitwarden
- [email protected]
Bitwarden users who store their email account credentials within their Bitwarden vaults would have trouble accessing the sent codes if they are unable to log in to their email.
To prevent getting locked out of your vault, be sure you can access the email associated with your Bitwarden account so you can access the emailed codes, or turn on any form of two-step login to not be subject to this process altogether.
…which you keep in a separate secure location in case you lose your 2FA device.
Why can’t I keep my password in a secure location then?
obviously you do but it can be leaked, phished, or hacked in other ways. a second “factor” such as possession of a token device is a safeguard against that.
you can actually read about all this many places online, it’s nothing new: https://en.wikipedia.org/wiki/Multi-factor_authentication
From the wikipedia link you posted:
It also lists more advantages than disadvantages.
yes, that’s the whole point, to recover your account if you lose your MFA device. what are you even trying to say?
edit:
the article lists 3 very important advantages, and 9 relatively small/niche disadvantages (or even irrelevant in the case of SMS). mobile MFA makes sense for the vast majority of people, of course there are always edge cases who it may not work for.
If you can login without the second factor then what’s the point?
We already covered this at the top. You keep the recovery codes unexposed to the internet or obfuscated in some way, unlike your usual password. Therefore you can have confidence that they haven’t been hacked, leaked, or whatever like passwords often are.
anyway I tire of your sea lioning. if you are truly asking good faith questions you can research on your own from here.
How is a strong password I used exclusively for Bitwarden “exposed to the internet”? I do see the value of this for people that don’t care about security and reuse the same password everywhere. In that case you would need something like phishing to expose the 2FA code or the recovery code, just a leak of the email-password combination from another website would not be enough. But what’s the point if I’m already using a unique strong password specifically for Bitwarden?
shit, why can’t i just keep the secondary password instead of relying on notoriously insecure sms, or notoriously privacy invading email?
why am i forced in some instances to rely on third parties?