I think I just don't quite understand what this concept would look like with Bitwarden (or most password managers, I guess). If that physical key is defined then you have it. Yubikeys are interesting concept, but requires that physical key. For someone who has a company shared database 2FA and also a database for company personal logins, this is an issue. Or do I have this backwards, and it would just allow me to unlock a vault that I have previously entered my master password with? What happens to offline access to my vault in that case? I really do have secrets in my vault I use, even if I don't currently have Internet access.or if I need to do an emergency export of the vault because The Big Quake just destroyed the Bitwarden servers in Washington State. the one issue I have run into with authy is that you can only have ONE account at a time on the desktop version. This will create a new approval request for the given Authy ID and send it to the end user along with a push notification to the Authy Mobile app(s), Desktop app(s), and any SDK-driven apps. I do not like the idea of having to take additional protections to prevent it from being stolen. For information on other channels such as SMS or soft tokens, see the Authy API One-time Passwords documentation. I can get away with this because it does no one any good - on any site it protects - without the site's password and possibly even the Yubikey's PIN. Right now my Yubikey is on my key ring, which is in plain sight in my home. If you steal my Yubikey and have my email address (which is only lightly guarded), you have access to my vault. On the other hand, if I understand where everyone is going with this, it turns my Yubikey into an attack surface. Lord, we see that problem often enough on Reddit that could be a major benefit for some users. I do like the idea of users avoiding the risk of forgetting their master password. I keep going back and forth on this exact question.
0 kommentar(er)
