Hi there,
Just seeing this forum and Bitwarden has his own authenticator app?! Can someone answer the following questions regarding it.
@Vlumondoxa Iām a bit lazy this morning, writing answersā¦ but maybe here are some answers already:
Thanks @Nail1684! I like your ālazy answerā 
! Iāll check out the links and wait for some more responses.
Thanks! 
Bitwarden help pages are a really awesome resource.
If you store your TOTP seeds into bitwarden, all eggs are in the same basket. A compromise of your bitwarden account means a compromise of all the accounts stored in it. Even if they have 2SV turned on.
Itās a balance between security and convenience, you have to decide where you feel more confortable.
I have my TOTP seeds in bitwarden, and focus my effort in protecting my bitwarden account.
This confuses me.
I try to translate (@kpiris please correct me if Iām wrong):
āI have my TOTP seeds in bitwarden, and focus my effort in protecting my bitwarden account.ā
It means, he decided a bit more for the conveniency of using TOTP with the integrated authenticator in the Bitwarden password manager, instead of using the dedicated Bitwarden authenticator app (or any other 2FA/TOTP app for that matter).
And āprotecting the Bitwarden accountā would mean something like āthe usualā (not a comprehensive list):
ā¦ and this is always important, but all the more if you have āall eggs in one basketā (like the TOTP seeds also stored in your vault, as was the topic here)ā¦ 
Hmm a good master password is what I have at Bitwarden and I need to access the 2FA via my Proton Mail which requires me to use my face ID.
Just one comment to that: hopefully you donāt have ācircular dependenciesā here, because if you need access to Bitwarden to access Proton Mail to access Bitwarden (your 2FA)ā¦ then you still get into trouble if you loose access to Bitwarden in the first place (for whatever reasonā¦ and put in other words: you need to be able to access Proton Mail - in your case - even if you didnāt have access to Bitwarden)
Well, I can access Bitwarden on multiple devices so I donāt think Iāll lose access to that.
Better assume you can loose access (ābetter safe than sorryā). One server update (e.g.) that automatically logs out all your devices would be enough (and those kind of things can happen).
So in short: Bitwarden 2FA to login is useless?
No.
My āin shortā would be: You have to have a ābackupā of your 2FA method and/or must be able to access your Bitwarden-2FA even without access to Bitwarden. (simple analogy: donāt let your key for your car IN your carā¦)
PS: You donāt have your key (2FA) in your car (Bitwarden)ā¦ but if you need access to Bitwarden to get access to your car (2FA)ā¦ I hope you know what I meanā¦
But how would I do that?
So the authenticator would be for example a good backup for 2FAs?
Good luck at your appointment!
Your emergency kit should include everything necessary to get back into your vault, presuming the only thing you have is a brand new PC/phone that you just picked up from the store.
Notably, if using MFA, it should include your Bitwarden recovery code. And, if you need access to your email to get back into Bitwarden, it should include your email username, password, and if applicable, its recovery code.
Seems @Nail1684 has already pointed out the fallacy of this assumption, but it bears repeating: there absolutely are situations in which all of your Bitwarden apps and browser extensions can become logged out at the same time ā and without warning. Too often, we see users who become permanently locked out of their Bitwarden vaults (losing access to all of their data) when their Bitwarden apps are unexpectedly logged out. Donāt let this be you (or your parents)!
On the topic of where to store TOTP keys for accounts that use TOTP as 2FA, for maximum security (which also implies maximum inconvenience), TOTP keys should be stored (and TOTP codes generated) in an app that is installed on a device where you are not also using Bitwarden. Therefore, if a device where you do use Bitwarden is compromised (by malware or physical theft, for example) and your vault is breached as a result, then the attacker will (presumably) be unable to access your accounts ā because they do not have access to the TOTP codes which are on a completely different device.
For maximum convenience, get a Premium subscription (or Family plan), and store the TOTP keys in your Bitwarden password manager, which allows the password manager to generate your codes (and to autofill those codes into your login forms). The risk is that you are unable to properly secure your Bitwarden apps (e.g., failing to keep malware off your devices), then your vault could become compromised, allowing an attacker to access all accounts stored in your vault (since they have both the password and the 2FA).
A compromise would be to use the more convenient approach (generating TOTP codes in Bitwarden) only for less important accounts, and use the more secure approach (keeping 2FA away from Bitwarden) for the more important accounts (banks, etc.).
There is a good beginnerās guide to Bitwarden floating around the Bitwarden sub on Reddit, and you might benefit from reading it.
I wonder who wrote that guide. 
Coming back to that point about ā2FA backup for Bitwardenāā¦
Since there are five ways to set up 2FA for Bitwarden (FIDO2, TOTP, email, Yubico OTP and DUO), there are numerous combinations of what one can do. So, in general I would say:
[BTW, the 3-2-1 backup rule could be also mentioned in that contextā¦ in a short version: 3 copies, on 2 different media, at least 1 off-lineā¦]
So essentially, the main points again: 2FA recovery code as the ultimate fallback - and maybe more than one form of 2FA (e.g. email and TOTP) or a form of 2FA which allows āa backupā in itself if you will call it that way (e.g. TOTP/TOTP-app - and storing the seed code/secret key on your emergency sheet).
ā¦ Hm, I think it was too long. I think it was too confused. It mainly focused the ābackupā/fallback problematic. I hope, someone can put meaning into my writings. 
So, how do I setup emergency access exactly?