Unlock the integrated TOTP authenticator separately from the password manager (improve 2FA security)

I understand the point of Bitwarden is to only have 1 password for everything but the point of a TOTP in theory is to require a second piece of information.

I think Bitwarden should have the option to allow users to protect TOTP codes with a second, separate, master password so it can effectively function as an independent TOTP manager

1 Like

Not really. The idea is to have to remember 1 password only so that “everything” can have a unique password you do not have to remember.

1 Like

Furthermore: The TOTP is the second factor which is protected by the password you use for your Bitwarden account. And in case that this will make you feel better: Bitwarden is about to introduce the “Master password reprompt”. For details on this see here:

3 Likes

Separate Password for 2FA

  • I really like the idea of keeping my passwords and my 2FA-Codes in one place (Bitwarden)
  • Sadly that kinda compromises the purpose of 2FA
  • Therefore I’d like to be able to set a separate Password, which I have to fill out before I can access a 2FA-Verification-Code

Feature function

  • Allow users to set up a separate and unique password for 2FA-Verification-Codes/TOTP
  • Bitwarden will ask the user for this password whenever the user tries to copy a 2FA-Code
  • This way Bitwarden can be used to store both the login-data aswell as the TOTP-data without compromising security too much

What do you guys think?

If this is that important, to me it looks like it’s better to use a separate solution for your 2FA codes?

3 Likes

Yep I do agree in a way - at least regarding the added security of 2FA.
I do just personally really like the idea of having everything in one place, which is my reason to suggest this kind of “midway solution” :slight_smile:

I do get your point though!

1 Like

The “Master password reprompt” is different from a second, different master password that the OP was asking.

If it’s just reprompting the same master password again, then the TOTP is no longer the second factor.

I would like to have this feature too, so that I don’t need to create two Bitwarden accounts (one for 1st factor passwords, one for 2nd factor TOTP tokens). I know I need to remember two master passwords anyway, but at least I don’t need to register another email address just to create the 2nd Bitwarden account and pay twice.

Sadly this is archived and I cannot vote for it.

Can this be un-archived in order to allow voting?

I wouldn’t place my 2fa into bitwarden without this feature. Use of 2fa inside of bitwarden should be protected by a separate password – and bitwarden should encourage its use from a different device. In other words, when on your PC and trying to log into a website, you should use your bitwarden browser extension to fill in the password, then use the bitwarden on your phone to get the TOTP code! That way, if there is a keylogger on your PC, the worst they can do is get into your bitwarden password vault, but not the 2fa. (yes this requires some discipline on the user’s part, but bitwarden could strongly suggest this method within its interface somehow. At least provide a warning of some kind, because users, including myself never think of these things!)

Sidenote: I changed the title of this Feature Request from “Separate Password for 2FA (Verification Codes/TOTP/Authenticator Keys)” to “Separate password for access to the integrated authenticator (2FA TOTP codes / Authenticator Keys)”.

I have merged two related threads (“Separate password for access to the integrated authenticator” and “TOTP - protect with second master password”).

Furthermore, the topic title has now been changed to “Unlock the integrated TOTP authenticator separately from the password manager” in recognition of the fact that some users may prefer other unlock methods than entering a second password, and the fact users may have different preferences for how often the authenticator unlocking mut be performed (hence, it is likely that this feature will need to include configurable timeout settings for the authenticator locking).