Hacker News new | ask | show | jobs
by ajyey 1647 days ago
I use Microsoft’s Authenticator and so far have had no problems. I also use 1Password’s built in 2FA functionality which is a little redundant but it makes filling in 2FA code on websites and apps very easy.
3 comments

Using tools like 1Password and Bitwarden to manage your OTP codes, while arguably better than not using OTP at all, is a bad idea.

If you password for $service is exposed in a dump then you're ok but if your password manager is exposed then both factors of credentials are exposed. Using a separate app is definitely more secure.

You can use Google Authenticator without being a Google user, but Authy is another pretty reputable app which might be worth a look.

I started using Microsoft Authenticator for work, since I have several O365 accounts that require it. Ended up really liking it and use it for all of my TOTP now, with Bitwarden as my password manager. Also have a yubikey, for other purposes.
Just so you know- the article I've now linked in the original post found some nontrivial issues with Microsoft's Authenticator