The latest pixel devices (since 6 I think?) already provide accees to a /dev/kvm device, so maybe you could even run a normal Ubuntu server VM on your phone for hosting these services.

I guess he means that raspberry pi doesn’t run a mainline kernel

deleted by creator

Arguably, if you use 2FA to access your passwords in 1password, there’s little difference between storing all your other OTPs in 1password or a separate OTP app. In both cases, since both your secret passwords and OTPs are on the same device (your phone), you lack a true second factor. The most likely way someone would gain access to 1password secured with 2FA is if they control your device and it’s been compromised, and having your OTPs separated wouldn’t provide additional protection there. Thankfully, the larger benefit of OTPs for most people is that they are one-time-use, not that they originate from a second factor.

As you said if you have both the password manager and the OTP manager in the same device it goes against the concept of 2FA, and you can throw most of guarantees out the window.

I think one distinction worth making is that the encrypted vault itself is still only protected by one factor, the password. The OTP 1Password asks you is part of their service authentication mechanism. If for some reason the attacker manages to get an encrypted copy of your vault (Via App cache, Browser add-on cache, mitm, 1Password’s servers, etc…), “all” the attacker needs is to brute force your password and they can access the contents (Password and OTP seeds) of the vault without requiring the TOPT token. Yes you can mitigate this with a good password/passphrase, but as GPUs/CPUs get faster will that password continue to be good enough in few years time? If your master password becomes “easily” brute forceable, now the attacker has access to all of your accounts because you had the password and OTP seeds in one vault.

If you truly feel you need a second factor though, you’ll probably want to look at something like a Yubikey or Titan. I’ve considered getting one to secure my 1password vault to reduce the risk of a lost phone compromising my vault.

I have one, but unfortunately the amount of services that support U2F as a 2FA mechanism is relatively small and if you want to talk about FIDO2 passwordless authentication even less.

That’s a fair point. I just wanted to highlight that there may be cases where a password manager isn’t automatically protected by 2FA by the two factors you mentioned (The password you know and the copy of the vault) since in the case of bitwarden fulfilling one can give you the second. In order to actually achieve 2FA in this case, you would need to enable OTPs.

Many password managers use a biometric factor to sign in

The only thing this does is replace the authentication mechanism used to unlock the vault, instead of using your master password (something you know), it uses some biometric factor (something you are), although it uses your biometric data, it’s still a single factor of authentication

This basically moves the MFA aspect to one service (your password manager) instead of having each service do their own thing

I am not sure I understood you here. What do you mean by “instead of having each service do their own thing”? Each website using their own method of delivering OTPs?

It also comes with the benefits of password managers - each password can be unique, high entropy, and locked behind MFA.

I am not discrediting password managers, they have their uses, as you mention you can have unique, high entropy password on a per service basis. The only thing I am against is the password managers themselves also doubling as OTPs generators (take a look at Bitwarden Authenticator which kinda defeats the purpose of OTPs. From the perspective of OTPs it makes much more sense to use a separate application (Like Google Authenticator or Aegis Authenticator), preferably on a separate device, to generate the OTPs.

That’s not quite right though, there’s the factor you know (password to your vault), and the factor you have (a copy of the encrypted vault).

That would be true for offline vaults, but for services hosted on internet I don’t think so. Assuming the victim does not use 2FA on their Bitwarden account, all an attacker needs is the victim’s credentials (email and password). Once you present the factor you know, the vault is automatically downloaded from their services.

This is something I hadn’t thought until know, but I guess password managers might(?) change the factor type from something you know (the password in your head) to something you have (the vault). At which point, if you have 2FA enabled on other services, you are authenticating with 2 things you have, the vault and your phone.

Although it’s true that you are increasing the attack surface when compared to locally stored OTP keys, in the context of OTPs, it doesn’t matter. It still is doing it’s job as the second factor of authentication. The password is something you know, and the OTP is something you have (your phone/SIM card).

I would argue it is much worse what 1Password and Bitwarden (and maybe others?) allows the users to do. Which is to have the both the password and the OTP generator inside the same vault. For all intents and purposes this becomes a single factor as both are now something you know (the password to your vault).

I think the admin of c/selfhosted is the admin of Lemmy.world

Made my own for myself and some friends. We couldn’t be bothered creating account on the larger instances and have power tripping admins de-federating instances over trivial issues.

I think those kind of vulnerabilities are pretty rare, though.

Not really… If you go read the security bulletin from google, you will see every month that there are a couple of issues fixed on closed source components https://source.android.com/docs/security/bulletin/2023-07-01

Also vulnerabilities related to kernel code, I highly doubt most ROM “developers” are actually backporting security fixes for that specific device’s kernel branch/source.

You can update your phone with custom ROMs, but it won’t update the closed source components of it(device drivers, bootloader, etc…). If a vulnerability is found in one of those components, it’s unlikely that it will get parched

I think bitwarden fills all of your requirements.

If you use [email protected] to link a user, lemmy will instead create a link for the instance you are currently using.

GrapheneOS uses exec spawning by default, but it’s pretty trivial to disable and it does speed things up (at a slight cost to security).

Even with that option disabled the slow down was significant enough. Maybe the mid-range chip used in the Pixel 5 wasn’t helping, but still… Overall the phone felt significantly quicker when switching back to stock.

I think using AOT rather than JIT compiling might be the cause of the slow installs, but I’m not sure (and I’ve not really noticed a problem myself).

That’s it, I remember reading in their forums one of the mods(or devs?) mentioning this.

In Europe I would say debit cards are way more common than credit cards. It’s very rare to see someone paying with a credit card.

I ran GrapheneOS on a pixel 5 but ultimately went back to stock.

GrapheneOS was considerably slower on my phone. Apps took a bit longer to loader, but the worst was installing APKs, it takes so much longer compared to stock. Some apps (e.g. revolut) took more than 5 minutes to install, it was crazy.

What kind of “control” do you mean? Your posts/comments get replicated across all the other instances. You can’t really “guarantee” a delete, since the other instances might just ignore your request for delete.