• 0 Posts
  • 15 Comments
Joined 1 year ago
cake
Cake day: July 5th, 2023

help-circle



  • The alternative is on desktop always get your smartphone, open some app type a token or on the phone to switch to multiple apps to get your credentials. Not fun imho.

    There are desktop apps for OTP, you don’t need a phone. And since you only need to setup an OTP secret once, doing it for your phone and pc isn’t that big of a deal.

    I have my OTP secrets in 3 places, 2 yubikeys and my phone’s authenticator app, with the former meant for my PC.

    For me, the key benefit of 2Fa is getting more security against leaked, stolen, phished passwords, and that still holds up.

    If your vault doesn’t have 2FA too this doesn’t hold up though. Means you’re trusting a single service that can get hacked with all your secrets. Sure, your other accounts are more protected against leaks and stuff, but if your password vault isn’t, you didn’t really change much, just pointed the hackers to one single place.

    Yes I know hacking a password vault isn’t some walk in the park and rarely happens, but the point is any leaks from it would be 10 times more catastrophic for you if all your OTP secrets are also stored in it. I’ll spare myself from that nightmare with the small inconvenience that is a separate, offline OTP app.


  • This isn’t really a good idea because then you’re putting all your eggs in one basket. The whole point of 2FA is that the second factor is in a separate location so if your first factor (password) gets compromised the second one (OTP code) still protects your account. If both factors are in one place you’re back to a single point of failure instead of 2, losing a key benefit of 2FA.

    If you’re gonna do this, at the very least have 2FA with a security key on your bitwarden vault.


  • Yeah it’s not the perfect model for sure. Usually you did get updates to fix vulnerabilities and bugs, but any major version release would require a new purchase/license.

    But any software that requires connecting to a server anywhere just doesn’t work in this model.

    In the end there’s not much of a choice. Either you pay more for apps to compensate for the time spent on them, subscribe to reduce your costs and assure continuous revenue, or ads.

    Anything that’s perpetually free, unless it has massive communities willing to maintain it, typically ends up like the tools we see here: abandoned/sold.


  • In ye old days the reigning model was a pseudo subscription where you paid for a version of a program and that’s all you got, if you wanted the next version of that program you had to buy it again. This made developing updates profitable and people who didn’t care to pay for the update could still use the outdated program. It wasn’t perfect by any means but I feel like it was one of the better compromises compared to everything else.

    Sadly with the advent of mobile apps such a model is heavily discouraged.


  • IdleSheep@lemmy.blahaj.zonetoMemes@lemmy.mlEmail clients
    link
    fedilink
    arrow-up
    2
    ·
    edit-2
    10 months ago

    Not just normies. I liked using thunderbird but it felt so bloated for my use case (not to mention the sluggishness) . I just want to read my email, I don’t need an entire suite of things like calendars or extensions (I understand why people use them, I just do not need or want them). Mailspring was by far the best option for me.