Is this some sort of a convenience feature hidden behind a paywall to justify purchasing their subscriptions or does generating the codes actually cost money? If the latter is the case, how do applications like Aegis do it free of cost?

    • FlumPHP@programming.dev
      3·
      2 years ago

      The “Product Led Growth” crowd doesn’t care about charging based on what things cost. They only care about what the buyer will tolerate. The “value metric” that pisses me off the most is per user pricing when the service doesn’t incur costs per user.

    • 7heo@lemmy.ml
      4·
      2 years ago

      Naaah, in “Multiple factor Authentication”, the word “factor” is just to look cool… The original MfA meant “Multiple fields Authentication”. (I’ll see myself out)

      • darcy@sh.itjust.works
        2·
        2 years ago

        i dont think i know what youre talking about?.. but factor refers to one of three types: something you know (passwords), have (totp or yubikey), or are (biometrics). having 2 passwords is almost the same as having one password, since they are the same factor. thats why having totp linked to your password manager is basically like having 2 passwords. it almost defeats the point

        • 7heo@lemmy.ml
          2·
          2 years ago

          I made a joke, basically saying that if you use a single device, it’s “Multiple fields authentication” as opposed to “multiple factors authentication”.

  • nakal@kbin.social
    312·
    2 years ago

    TIL password managers charge for 2FA.

    1. Get a free password manager.
    2. Get a free 2FA App. Please don’t mix passwords and 2FA so you don’t reduce it to 1FA.

    For 1) I use PasswdSafe, because I can merge databases with Password Gorilla as I like.

    For 2) I use Aegis. You can download an icon theme, which is quite cool.

    • hh93@lemm.ee
      17·
      2 years ago

      For the 2nd point:

      Mixing it doesn’t reduce it to 1fa - it still makes your accounts immune to Passwort leaks and common attacks

      You are only at a 1FA level if someone hacked your PW-Manager but in that instance you’re most likely fucked anyway

      Sure for the most important accounts having 2FA in another app is good so you can at least secure those if the PW-Safe leaked but I have 2FA on every single website I use(d) that offers it - even if I’m only on there once a year so using a special app is less important than just having the additional security in the first place

  • ddnomad@infosec.pub
    267·
    2 years ago

    Please don’t use your password manager for TOTP tokens. It is called two factor authentication for a reason.

    • beeb@lemm.ee
      31·
      2 years ago

      The reason that 2fa exists is not to protect you if someone gets their hands on your device. It’s to protect you if your “static” credentials leaked from a providers’ database or you otherwise got phished. Using a password manager to handle mfa is totally reasonable.

      • 4am@lemm.ee
        8·
        2 years ago

        If you are really worried about the password manager being an intrusion vector, secure your vault with a hardware key.

        • Acters@lemmy.world
          41·
          2 years ago

          You can be paranoid and split the two, but most people(99%) will be perfectly fine with KeePass.

      • ddnomad@infosec.pub
        1·
        2 years ago

        It is reasonable yet subpar under a threat model where you do not trust any single provider, which is a model I find appropriate most of the time.

    • auth@lemmy.ml
      2·
      2 years ago

      I do that mainly for accounts I don’t care about but either way it does increase security as compared to just a password in many cases… I just wish that some of these services didn’t require TOTP

  • slazer2au@lemmy.world
    6·
    2 years ago

    Because the business model works that way.

    Draw them in with features and lock the actual security features behind an additional pay wall.

    Enterprise environments is rife with this kind of crap. Sso.tax lists some of the worse ones.

  • jet@hackertalks.comEnglish
    0·
    2 years ago

    bitwarden does it behind a convenience fee, fair enough, its a worth while service to support. If you self host, you have no such barriers.

  • Vexz@kbin.social
    27·
    2 years ago

    If you like Bitwarden you might wanna search for a publicly hosted Vaultwarden instance that accepts user registrations. You’ll get Bitwarden with its full premium feature set.

    • Railcar8095@lemm.ee
      8·
      2 years ago

      Not 100% on board with that idea. There is no guarantee the server is not tampered. Unless you know and trust the host, Bitwarden premium is very affordable and Vaultwarden can be hosted even on free VPS. Or you can even use a KeePass fork (I’m not up to date as to what the best ones are) with any form of online sync.

      • elia169@kbin.social
        5·
        2 years ago

        KeePassXC (windows/macos/linux), KeePassDX (android) are what I use. I sync the databases between 4 devices with Syncthing.

      • Vexz@kbin.social
        1·
        2 years ago

        Well, yes, I agree on that. Just wanted to name another option in case that’s okay for the OP. I host my own instance on my private NAS and I absolutely love it. :)

      • auth@lemmy.ml
        11·
        2 years ago

        What’s the best free VPS? I pay about $15 per year for mine… But its good enough to run woocommerce/wordpress for a small store