tom here from learn systems and i am happy to report here in december of 2021 many many websites are now supporting two factors of authentication. This is great until you then think about how you have to deal with all this two-factor authentication. One of those methodologies, especially in specifically with TOTP, one of my favorite methods, which is time-based authentication. I have a whole video on it. I'll link down below, but time-based authentication is really popular. It's really simple. It doesn't require any third-party interaction servers. You just have to have a shared secret and agree upon what time it is between you and the server. And time, I think, is pretty well agreed upon, I hope. But once we've determined that, then where do we put that data? Now, one of my favorite apps to use on my phone has been for quite a while Aegis, and I'll leave a link to that up. But it's a nice app that runs on Android that does allow you to store all your TOTP authentication. But when you start having many many

things with totp you kind of go you know it'd be nice if these were in bit warden. And good news bit warden allows you to store it. Now bit one's very convenient with the way it stores it because as it puts it in there it'll also do fun things like copy it to the clipboard whenever you do an autofill for username and password. So for example when I log into truenas here username password fills it in and copied right away to the clipboard the totp authentication so I can just hit paste and log right in. Now when do you and when don't you save things in bit warden is a question that's come up quite a bit and this is kind of a fuzzy area and it'll come down to how you want to do things. So saving a bit warden and having 2fa is better than not having 2fa we'll start there. So if you have no way of managing these apps separately well I least would say start with using bit warden when it comes to the way we

manage it. Let's start with how we manage Bitwarden. First, Bitwarden. There are no known vulnerabilities in it. Here in December of 2021, they go through regular code reviews and regular audits. So I want to talk about theoretical where I think the potential problems could occur. First, we sell Phil Bitwarden, and I've got reviews on talking about that. And the self-hosted Bitwarden is only accessible behind a VPN, so we keep it quite locked down. But we use the Bitwarden plug-in here at my office and saving things in a plug-in that then talks to the server means that it's in the browser, and the browser could be, and obviously is where so many attacks are occurring because that's how we interact with the greater internet. That is the part that is exposing us beyond our firewall. Therefore, if by some magical way, or really good hacking (it's not really magic), and someone was able to break those boundaries to somehow reach out of the browser's sandbox that it has.

and grab something out of one of those plugins, such as Bitwarden. That would obviously be where I could potentially see a threat surface, but it seems really, really unlikely because there's a really large group of smart people working to keep this very locked down. But I still just on that small, small risk that that could occur. I make sure that my passwords for things that are well IT-related in terms of what we use to manage our customers. We keep that separate in that Aegis app on my phone. And I don't even use Bitwarden on my phone. Just one of those one more keeps it separate that way. My phone is the place where my TOTP second factor authentication is stored. And Bitwarden itself, with only a browser plug and load, is where my username and password is. And then all these different sites that are things for IT documentation or IT management and any of these things that I've you know talked about different on a channel here because what we use to run our business that interacts with our

customers, we make sure these remote control applications because, well, it would be absolutely dangerous to have someone log in there because they would then gain access to many of our client systems, even domains and things like that. I keep those all separate. Where do I put things in Bitwarden? Well, first, my lab, that one makes it easy. I always set up, even though it's a lab environment, and just in case, I set up randomly generated passwords along with my Bitwarden 2FA. Makes things really simple to paste in. Then the next one's expanding out from there is going to be all the different forums I belong to. When you sign up for them, I mean they have TOTP authentication as an option. I'm signing up for it and saying yes because I'll put it right in Bitwarden. Same with some of my personal life, my games and things like that. Yeah, I'm not too worried. I mean I would be greatly upset if someone were to log into some of my games, but I mean it's just way convenient and not having

that clutter up my phone so my phone has got a little bit shorter of a list. Yes, it just supports filtering so I can filter it each time, but you're just narrowing it down for where I use him and where I don't. Like I said overall I wanted to answer this question and see what the audience thinks as well because go ahead and leave your comments down below if you think I'm a little bit overly cautious not want to put them all in Bitwarden or I'm crazy for putting any of them in Bitwarden and I kind of like to see both sides of it. I actually started this discussion on Twitter about how people handle it and it's one of those things that's going to be a bigger and bigger issue is handling authentication in general as more and more sites have different methodologies and some of them use no user and password anymore. They send everything what they refer to as like magic links to set cookies. It's going to be interesting watching how identity management kind of grows in the

future. At least we've come a lot further than we were from the early days of the internet where we just sent everything over clear text and telnet for management. To you know, 25 years later in my career where things are much more encrypted, much more locked down, key managed with things like ssh, and handling username, password, and password manager. So we've come a long way on here. I'm excited where we're going to go next, but still managing all that is a big thought process. I always like to try to always be rethinking through it, keeping an eye on what's important. And yes, it's not done yet, but I am working on where I use ubi keys as well because someone's going to ask about them. I've not done a video yet on yubikeys. That'll be in the future, but that future maybe right now. So if there's a video on newbie keys, go ahead and check my channel for that. Uh, it kind of depends on when you're watching it, but as of publishing today, December 5th.

2021. There is not one, all right, thanks and leave your comments down below to let me know if I'm crazy or if I should have put a tinfoil hat on before even making this video. Thanks and thank you for making it all the way to the end of this video. If you've enjoyed the content, please give us a thumbs up. If you would like to see more content from this channel, hit the subscribe button and the bell icon. If you'd like to hire a sure project, head over to lawrences.com and click the hires button right at the top. To help this channel out in other ways, there's a join button here for YouTube and a Patreon page where your support is greatly appreciated. For deals, discounts, and offers, check out our affiliate links in the description of all of our videos, including a link to our shirt store where we have a wide variety of shirts that we sell and designs come out well randomly, so check back frequently. And finally, our forums forums.laurensystems.com is where you

can have a more in-depth discussion about this video, and other tech topics covered on this channel. Thanks again for watching and look forward to hearing from you.

Should You Store TOTP Authentication in Bitwarden?

In-depth tutorials, discussions on network engineering, security, and technology solutions.

Lawrence Systems  offers a look at how we run our company, the products we use and solutions we provide for our clients.  We discuss and create tutorials for firewalls, storage solutions, MSP tools, security tools and open source topics.  We do a live show every Thursday where we engage with our audience and have some laughs about working in the IT industry.

Shipping Address:
14140 Pennsylvania Rd.
Southgate MI, 48195

Content Creation Ethics and Guidelines can be found here:
https://www.lawrencesystems.com/content-ethics/