You’re welcome! I’m glad it worked so well and that I could be of help.
As a new premium user I was puzzled by this new ‘copy verification code’ button for codes generated by TOTP authenticator apps.
It does seem strange to keep usernames, passwords and TOPT codes in one place. But if bitwarden is only secured by a physical TOTP device like those from FIDO U2F or Yubico, then can see how having accounts in bitwarden that use TOTP app being transferred to the BitWarden Authenticator/account so they can be accessed via the ‘copy verification code’ button, could be helpful
I chose bitwarden as it costs $10, compared to $36 for lastpass for premium and with the ‘savings’ I have ordered a Yubico device.
Besides the usual prompt to use a unique password for each online account, I also use a unique email address for each and for bitwarden I use a paid for email service and use an alias email address, all protected by TOTP. The email service I use cannot be logged into with an alias address and I never user the email service username (email address) for
anything expect logging into the email service.
So I try to protect each of my accounts with a unique:
- email address
- password
- totp
and if the account is important I only use a physical totp device.
I also chose bitwarden as lastpass has far too many account recovery options + I do use the bitwarden ‘send’ function.
If I did not see the ‘copy verification code’ button I would never have realised the option existed! But if a bitwarden account is compromised having access to the TOTP codes could be seen as defeating the reason for using TOTP, this is why I ordered a physical Yubico device.
So if you only have a single Yubico device and no alternative this has become a single point of failure. What is your backup plan if that device is damaged, lost or stolen ?
Lost [all] Secondary Device[s]
Have a Recovery Code?
https://bitwarden.com/help/article/lost-two-step-device/
An NFC enabled Yubico device is the only NFC U2F that BW enables for mobile phone use, does not preclude use of any other FIDO U2F or non NFC U2F.
“If you will be using the YubiKey for a NFC-enabled mobile device, check the One of my keys supports NFC checkbox.”
https://bitwarden.com/help/article/setup-two-step-login-yubikey/
My exact BW configurations are based upon a threat model, that wold not be appropriate to discuss here, but it does take note of the ‘copy verification code’ button option.
Although this is an interesting question, please keep posts related to the topic. @tuttut shared experiences related to the TOTP functions, adding some context to the topic, that’s fine for me. But please, if you have direct questions/recommendations, send him/her/whatever a personal message. This keeps the topic compact and the Posts related to the feature request.
Hi Zeik0s, thanks for prompting me to reflect as a newbie on this forum. I had been looking at the topic, without realising I was in the ‘Feature Requests’ section. Have no problem with the ‘copy verification code’ button, but BW should add an explanatory note that is shown, when the mouse hovers over it, when the function is inactive (greyed out) and maybe a link to page on it’s site that explains it.
Agree this is needed.