Bitwarden 및 Aegis로 2단계 인증 관리하기

### Bitwarden 및 TOTP로 안전하게 2단계 인증 관리하기
* 🔒 "현재 많은 웹사이트가 **2단계 인증(2FA)을 지원**하여 보안이 강화되었지만 여러 개의 2FA 코드를 관리하는 것은 어려울 수 있습니다."
* 🕒 TOTP(시간 기반 일회용 비밀번호)는 **사용자와 서버 간에 공유된 비밀과 시간 동기화를 사용하는 널리 사용되는 2FA 방법**입니다.
* 📱 TOTP 코드 저장을 위한 안드로이드 앱으로는 **Aegis가 권장**되지만, 편의를 위해 **Bitwarden은 2FA 코드 저장도 지원**합니다.
* ❓ Bitwarden에 2FA 코드를 저장할지 여부는 개인의 위험 감수도에 따라 결정하지만, **2FA를 활성화하는 것이 활성화하지 않는 것보다 낫습니다.**
* 🔍 Bitwarden은 정기적인 코드 검토와 감사를 거치며 **브라우저 플러그인으로 인해 잠재적인 공격 표면**이 발생할 수 있지만, 보안 조치가 마련되어 있어 그럴 가능성은 낮습니다.
* 📱 위험을 완화하기 위해 일부 민감한 비밀번호와 2FA 코드는 **Aegis 앱과 같은 별도의 오프라인 저장소**에 보관됩니다.
* 🔐 실험실 환경, 포럼, 개인 계정의 비밀번호와 2단계 인증 코드는 **Bitwarden에 안전하게 저장**할 수 있습니다.
* 🔮 다양한 인증 방법을 채택하는 사이트가 늘어남에 따라 ID 관리의 미래는 진화하고 있으며, **인증을 안전하게 관리하기 위한 전략**은 계속해서 주요 고려 사항이 될 것입니다.

잠재적인 브라우저 취약성에도 불구하고 Bitwarden으로 2단계 인증을 관리하는 것은 특히 IT 관련 시스템과 고객 관리의 보안을 위해 매우 중요합니다.

tom here from learn systems and i am happy to report here in december of 2021 many many websites are now supporting two factors of authentication. This is great until you then think about how you have to deal with all this two-factor authentication. One of those methodologies, especially in specifically with TOTP, one of my favorite methods, which is time-based authentication. I have a whole video on it. I'll link down below, but time-based authentication is really popular. It's really simple. It doesn't require any third-party interaction servers. You just have to have a shared secret and agree upon what time it is between you and the server. And time, I think, is pretty well agreed upon, I hope. But once we've determined that, then where do we put that data? Now, one of my favorite apps to use on my phone has been for quite a while Aegis, and I'll leave a link to that up. But it's a nice app that runs on Android that does allow you to store all your TOTP authentication. But when you start having many many

things with totp you kind of go you know it'd be nice if these were in bit warden. And good news bit warden allows you to store it. Now bit one's very convenient with the way it stores it because as it puts it in there it'll also do fun things like copy it to the clipboard whenever you do an autofill for username and password. So for example when I log into truenas here username password fills it in and copied right away to the clipboard the totp authentication so I can just hit paste and log right in. Now when do you and when don't you save things in bit warden is a question that's come up quite a bit and this is kind of a fuzzy area and it'll come down to how you want to do things. So saving a bit warden and having 2fa is better than not having 2fa we'll start there. So if you have no way of managing these apps separately well I least would say start with using bit warden when it comes to the way we

manage it. Let's start with how we manage Bitwarden. First, Bitwarden. There are no known vulnerabilities in it. Here in December of 2021, they go through regular code reviews and regular audits. So I want to talk about theoretical where I think the potential problems could occur. First, we sell Phil Bitwarden, and I've got reviews on talking about that. And the self-hosted Bitwarden is only accessible behind a VPN, so we keep it quite locked down. But we use the Bitwarden plug-in here at my office and saving things in a plug-in that then talks to the server means that it's in the browser, and the browser could be, and obviously is where so many attacks are occurring because that's how we interact with the greater internet. That is the part that is exposing us beyond our firewall. Therefore, if by some magical way, or really good hacking (it's not really magic), and someone was able to break those boundaries to somehow reach out of the browser's sandbox that it has.

and grab something out of one of those plugins, such as Bitwarden. That would obviously be where I could potentially see a threat surface, but it seems really, really unlikely because there's a really large group of smart people working to keep this very locked down. But I still just on that small, small risk that that could occur. I make sure that my passwords for things that are well IT-related in terms of what we use to manage our customers. We keep that separate in that Aegis app on my phone. And I don't even use Bitwarden on my phone. Just one of those one more keeps it separate that way. My phone is the place where my TOTP second factor authentication is stored. And Bitwarden itself, with only a browser plug and load, is where my username and password is. And then all these different sites that are things for IT documentation or IT management and any of these things that I've you know talked about different on a channel here because what we use to run our business that interacts with our

customers, we make sure these remote control applications because, well, it would be absolutely dangerous to have someone log in there because they would then gain access to many of our client systems, even domains and things like that. I keep those all separate. Where do I put things in Bitwarden? Well, first, my lab, that one makes it easy. I always set up, even though it's a lab environment, and just in case, I set up randomly generated passwords along with my Bitwarden 2FA. Makes things really simple to paste in. Then the next one's expanding out from there is going to be all the different forums I belong to. When you sign up for them, I mean they have TOTP authentication as an option. I'm signing up for it and saying yes because I'll put it right in Bitwarden. Same with some of my personal life, my games and things like that. Yeah, I'm not too worried. I mean I would be greatly upset if someone were to log into some of my games, but I mean it's just way convenient and not having

that clutter up my phone so my phone has got a little bit shorter of a list. Yes, it just supports filtering so I can filter it each time, but you're just narrowing it down for where I use him and where I don't. Like I said overall I wanted to answer this question and see what the audience thinks as well because go ahead and leave your comments down below if you think I'm a little bit overly cautious not want to put them all in Bitwarden or I'm crazy for putting any of them in Bitwarden and I kind of like to see both sides of it. I actually started this discussion on Twitter about how people handle it and it's one of those things that's going to be a bigger and bigger issue is handling authentication in general as more and more sites have different methodologies and some of them use no user and password anymore. They send everything what they refer to as like magic links to set cookies. It's going to be interesting watching how identity management kind of grows in the

future. At least we've come a lot further than we were from the early days of the internet where we just sent everything over clear text and telnet for management. To you know, 25 years later in my career where things are much more encrypted, much more locked down, key managed with things like ssh, and handling username, password, and password manager. So we've come a long way on here. I'm excited where we're going to go next, but still managing all that is a big thought process. I always like to try to always be rethinking through it, keeping an eye on what's important. And yes, it's not done yet, but I am working on where I use ubi keys as well because someone's going to ask about them. I've not done a video yet on yubikeys. That'll be in the future, but that future maybe right now. So if there's a video on newbie keys, go ahead and check my channel for that. Uh, it kind of depends on when you're watching it, but as of publishing today, December 5th.

2021. There is not one, all right, thanks and leave your comments down below to let me know if I'm crazy or if I should have put a tinfoil hat on before even making this video. Thanks and thank you for making it all the way to the end of this video. If you've enjoyed the content, please give us a thumbs up. If you would like to see more content from this channel, hit the subscribe button and the bell icon. If you'd like to hire a sure project, head over to lawrences.com and click the hires button right at the top. To help this channel out in other ways, there's a join button here for YouTube and a Patreon page where your support is greatly appreciated. For deals, discounts, and offers, check out our affiliate links in the description of all of our videos, including a link to our shirt store where we have a wide variety of shirts that we sell and designs come out well randomly, so check back frequently. And finally, our forums forums.laurensystems.com is where you

can have a more in-depth discussion about this video, and other tech topics covered on this channel. Thanks again for watching and look forward to hearing from you.

Should You Store TOTP Authentication in Bitwarden?

In-depth tutorials, discussions on network engineering, security, and technology solutions.

Lawrence Systems  offers a look at how we run our company, the products we use and solutions we provide for our clients.  We discuss and create tutorials for firewalls, storage solutions, MSP tools, security tools and open source topics.  We do a live show every Thursday where we engage with our audience and have some laughs about working in the IT industry.

Shipping Address:
14140 Pennsylvania Rd.
Southgate MI, 48195

Content Creation Ethics and Guidelines can be found here:
https://www.lawrencesystems.com/content-ethics/

Lawrence Systems

2021년 12월부터 많은 웹사이트에서 2단계 인증을 지원하기 시작했으며, TOTP는 간편하고 제3자와의 상호 작용이 없어 인기 있는 인증 수단입니다.

Android에서 TOTP 인증을 저장하는 데는 Aegis가 선호되는 앱이지만, Bitwarden은 TOTP 데이터를 저장하고 로그인 중에 쉽게 액세스할 수 있도록 클립보드에 자동으로 복사하는 편리함도 제공합니다.

2FA 관리를 위해 Bitwarden을 사용하는 것은 개인적인 선택이지만, 별도의 앱 관리 시스템이 없는 경우 권장합니다.

보안 강화를 위한 비트워든 관리

Bitwarden은 알려진 취약점이 없으며 보안을 위해 정기적으로 코드 검토 및 감사를 받습니다.

브라우저 플러그인을 사용하면 공격에 노출될 수 있는 잠재적 위험이 있기 때문에 휴대폰의 Aegis 앱에서 IT 관련 비밀번호를 분리하여 보관하는 것이 좋습니다.

이러한 분리를 통해 TOTP 2단계 인증은 휴대폰에 저장하고 Bitwarden은 사용자 이름, 비밀번호 및 기타 비즈니스 관련 상호 작용에만 사용하도록 합니다.

Bitwarden에서 비밀번호의 안전한 저장 및 관리

원격 제어 애플리케이션을 클라이언트 시스템과 분리하는 것이 중요하며, Bitwarden은 이를 위한 안전한 솔루션을 제공합니다.

Bitwarden에서 무작위로 생성된 비밀번호와 2FA를 사용하면 다양한 사이트에서 인증 방법이 점점 더 복잡해지고 있음에도 불구하고 실험실 환경, 포럼 및 개인용 비밀번호를 쉽게 관리할 수 있습니다.

Bitwarden의 인증 처리와 신원 관리의 진화하는 방법론에 대한 논의는 안전한 비밀번호 저장의 중요성이 점점 더 커지고 있음을 강조합니다.

인터넷 보안의 진화: 개인적인 성찰

인터넷은 일반 텍스트와 텔넷을 사용하던 초창기 시절에서 이제는 SSH 및 비밀번호 관리자와 같은 암호화되고 잠긴 방법을 사용하여 먼 길을 걸어왔습니다.

인터넷 보안의 미래에는 UbiKey를 사용하는 것이 포함될 수 있으며, 제작자는 이 주제에 대한 향후 동영상을 고려하고 있습니다.

크리에이터는 좋아요, 구독 및 기타 온라인 플랫폼을 통해 참여와 지지를 독려합니다.

제가 도와드리겠습니다! 다른 채널이나 프로그램에 접속하고 계신 것 같습니다.

궁금한 점이 있거나 텍스트 요약에 도움이 필요하면 언제든지 문의해 주세요!