Bitwarden, along with a lot of other password managers, has a feature that allows you to
generate time-based, one-time passwords. These are the temporary codes you often have to
use to sign into websites as part of two-step or multi-factor authentication. This means
your password manager can handle both factors in your multi-factor authentication. And,
uh, that doesn't sit right with a lot of people. I mean, once you put both of your
factors into the same place, doesn't this mean you've effectively made it single-factor
again and wiped out the security benefit? It might be convenient, but is this feature
actually a security clanger that fundamentally breaks multi-factor authentication? No. No,
it doesn't. I'm going to explain why, because people have been asking; but it's also kind
of the wrong question. The real question is, "Should you be using it?" and the answer
to that is a bit more complicated. To tackle this one we need to go back to basics on
what multi-factor authentication means, because a lot of people think it means multiple login
steps, but this isn't the case. It means proving your identity in more than one way.
The generally accepted ways are the inherent factor (something you are), the knowledge factor
(something you know), the possession factor (something you have), and the location factor
(somewhere you are). To be multi-factor, you have to use more than one factor. Not the
same factor twice. That doesn't count.
Authenticating with two physical devices is still single-factor.
It doesn't need to be intrusive, either. In the first video I made for this channel
I sat down at my computer and it unlocked itself automatically. I didn't need to do
anything; but it authenticated me using a 3D infrared scan of my face, and it authenticated
the phone in my pocket using Bluetooth. So it was actually multi-factor. Let's apply
this to Bitwarden. In our password manager, we have the two factors needed to log into
a website. We have a password and a TOTP code. Which factors are these? Your first reaction
was probably to label the password as knowledge factor and the TOTP code as possession factor.
Right? Wrong. How can the password be something you know? You didn't know it. You had to
log into a password manager to look it up. What device is a TOTP code proving you have
in your possession? If it's in Bitwarden, you can generate it using any device with
a web browser. In actual fact, neither of these two items are authentication factors at all, and
you're not using them to authenticate yourself. Why? Because the authentication isn't happening
here. It happened when you logged into Bitwarden. That is the point at which you had to prove
your identity, and hopefully you did use multi-factor authentication to do it. So what are
these for if not authentication? This isn't your authentication. It's simply your proof
that you have already been authenticated. Let me give you a practical example. If I
want to get on a plane and fly to Italy, I need a passport. To get a passport I need
to go through a whole bunch of checks with the Passport Office. They'll need a bunch
of information about me. They might need my birth certificate, my parent's birth certificate,
a picture of me, a signature from someone who's known me for many years and a way
to identify them. They'll authenticate me pretty good; but here's the thing: I don't
need to do any of that when I get to the airport. I don't have to bring my parent's birth
certificate to check-in. I don't need to have a friend come along and confirm to the
cabin crew that, yes, they recognise me. I just hand them my passport. The passport is
proof that I have been through that authentication process, and that's all they need to see.
A lot of the internet works like this too. Let's try this: open a new tab, incognito,
and log in to YouTube. When you get to the part where you have to enter a username and password,
stop. Look at the address bar. You're not logging in to YouTube. You're logging in to
Google. In internet terms, YouTube is a service provider and Google is an identity provider.
In our analogy, YouTube is the airport and Google is the passport office. How does YouTube
know to let you in? The same way the airport does: it checks you have a passport. In this
case, the passport is a signedauthentication token provided by Google, but the part I want
you to remember is this is just one token. There's no multi-factor going directly into
YouTube. There's just a token that acts as proof that you authenticated to Google. YouTube
doesn't know or care how many authentication factors you used. That's Google's problem.
Back to Bitwarden. This is the same thing again, except it's
a kludge. Password managers are a vital tool to make the internet today usable, but they're
a kludge. They're a workaround for the fact that reusing the same password on multiple
sites is incredibly dangerous, and our brains can't remember what feels like infinity complex
passwords. We use password managers to kludge in this passport-style authentication for
sites that don't support it natively. The password manager is our Passport Office.
It's our Google. We authenticate to the password manager. That's the authentication that matters.
That needs to be multi-factor. The passwords and TOTP codes we get from the password manager
and present to the target website are simply the passport, the token. They're not our
authentication. They're our proof that we've already been authenticated.
At this point, some of you might question whether the second-factor TOTP code is even
necessary if this stage doesn't really count as authentication. Unfortunately, it is necessary.
Remember this is a kludge. The target website doesn't know any of this is happening, so
it still needs to ask for multi-factor authentication, even if the different factors actually come
from the same place in practice. I can't rock up the airport and tell them I forgot
my password, but I'd like to have a go at guessing the secret password please. It doesn't work
like that. I can't browse to YouTube and choose to bypass Google and log in via some
other means. It's Google or nothing. Because this target website is unaware that I'm using
a password manager it will let people just try and brute force a password, so it needs
to have the multi-factor options enabled to protect against that.
We also shouldn't just use a password alone as our password token, because passwords are
just terrible for security to begin with. The token that Google issues to YouTube is
not a static password. It's different every time, so if one of them gets somehow stolen,
it cannot be reused. Using the password in combination with the TOTP code adds some of
that security to our kludged passport; because the time-based component means you can't
just steal it and then use it again later.
OK, hopefully you're still with me. That's my explanation as to why using this Bitwarden
feature doesn't break the concept of multi-factor authentication. Now, the more important question
is "Should you use the feature?" There are some scenarios where it's almost a no-brainer
that you should use it, but let me give you an argument against it first. Some people
don't like to use it because they feel like it's putting all of their eggs in one basket.
If your password manager gets hacked and it contains both your passwords and your TOTP
codes, then you're pretty much screwed. To those people, I say "Yeah, that's a pretty
fair take." You should think about this stuff, but that's not to say it's wrong to use
it, either. A lot of people will try to mitigate this risk by having one app for their passwords
and another app for their second-factor codes, so you need to breach both apps to get into
their accounts.
OK, right, but let's keep the cogs turning. Where is your password manager most likely
to be compromised? Is it in the cloud? It shouldn't be. Bitwarden and any other half-decent
password manager will be using zero-knowledge encryption, so if they get hacked the bad
guys just get an encrypted mess that Bitwarden themselves can't read. Realistically, if
this is getting hacked in a way that the bad guys get access to your actual passwords,
it's probably your device that's been compromised. So let me ask you: do you use your password
manager's mobile app? Are your second-factor codes in a mobile app? If the most likely
breach point is one of your devices, is your phone now the one basket that contains both
your passwords and your TOTP codes? I've actually heard of people putting the apps
on separate phones because of this. Some people have two phones. One for work, one for personal
use, so it's a real thing they can do. Passwords on the personal phone, second-factor codes on
the work phone. But hang on, don't you need to carry both phones? If you get mugged, are
you now the one basket that contains both your passwords and your TOTP codes? OK,
right. Passwords on my phone, second-factor codes on my wife's phone. But wait, I spend
a lot of time with my wife. What are the chances if she gets mugged I'm with her and I get
mugged, too? Is my relationship now the one basket that contains both my passwords
and my TOTP codes? We could keep doing this. There's a nearly
infinite series of increasingly ridiculous solutions we could contrive and holes we could
pick in them. The point is it's a scale; and the further you go down it you basically
make life harder for yourself, and also harder for an attacker; and somewhere along that scale
is a point where you will feel that it's a good enough compromise between security
and convenience. Someone has watched this video and they're now planning to split
authentication tokens with a cousin in New Zealand so they both can't get mugged at
the same time. A lot of you are probably thinking two phones sounds like too much faff.
Some of you will think two apps is too much faff.
I don't think there's a right or wrong answer. It's down to your risk appetite
and the sensitivity of the data in question. Personally, I think separating your second-factor
codes from your passwords is a sensible idea; because although it's a little inconvenient
for you, it's another barrier to slow down an attacker. I don't think it's strictly
necessary, though. I think using this feature to store your TOTP codes is… fine. It's
more secure than what most people are doing, and if your password manager gets compromised
you've realistically got big problems anyway. In fact, I did say there are scenarios where
this is something of a no-brainer. The big one is shared passwords. Personally, this
is where I would choose to use this feature. In an ideal world, people will tell you shared
passwords shouldn't exist and everyone should just have their own. That's a nice fantasy
you have there. Let me introduce you to my kid's school where we have one parental
login, or a utility bill for which they'll only accept one named person to have an account,
or any number of single-login devices that we have to look after in the IT world. You've
two options here. One: disable multi-factor authentication so your spouse or colleague can
share the password; or two: have a shared TOTP code stored in your password manager, protected
by your own unique user accounts and authentication factors on the password manager itself, with
access to it tracked and audited. One of these options is acceptable and it's not the one
where you disabled MFA. If you want to sidestep this problem entirely, then the best
way to authenticate is not to use a password manager, but to use passwordless authentication.
Watch this video to learn how it works and why it's so much better. It feels like we're
finally starting to turn a corner on this one. Most of the accounts I've signed up
for in the last year support passwordless authentication, and the functionality is built
into basically every new device now. Just like the functionality is built into YouTube
to like this video and subscribe to the channel!