this post was submitted on 13 Oct 2025
127 points (97.7% liked)

Selfhosted

60831 readers
882 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
 

One more step to unhitching from Google...

Right now the only option I see in F-Droid is Aegis.

I'm not sure what to actually look for side from checking for unexpected permissions and reasonably frequent updates.

Hopefully something I can sync with a GNOME app...

you are viewing a single comment's thread
view the rest of the comments
[–] ikidd@lemmy.world 1 points 9 months ago (3 children)

Yah, I can't see a point to have another app/extension when Bitwarden has it built in, and it's a great password manager.

[–] lka1988@lemmy.dbzer0.com 2 points 9 months ago (1 children)

The point of 2FA is "something you have" and "something you know" to enter a secured system.

If you put both of those into one system that is accessible by one password, the whole concept is defeated.

[–] ikidd@lemmy.world 3 points 9 months ago (1 children)

My threat model isn't having someone take my computer and log into stuff so my concern when using 2FA is more about them having gotten hold of a password remotely. But a TOTP makes that password pretty hard to use, no matter where it's stored. And my BW is also protected by a Yubi/password combo, so I guess I'm just vulnerable to having that beaten out of me.

[–] lka1988@lemmy.dbzer0.com 1 points 9 months ago (1 children)

The other issue with this - If you lose access to that one system, you're SOL. It's a single point of failure.

[–] ikidd@lemmy.world 2 points 9 months ago

That I could accept as a good reason.

[–] ripcord@lemmy.world 2 points 9 months ago (1 children)

Wait, it does? Including in the mobile app? I don't see it.

[–] ikidd@lemmy.world 2 points 9 months ago (1 children)

Right under Password in the edit screen of an item: Authenticator Key. You put in the auth key the target site provides you when you enable TOTP and it will start generating timed tokens. Usually you'll also get a one-time pad of backup keys, I usually toss those in the Notes of the edit screen there as well in case something goes wrong.

[–] SteveTech@aussie.zone 2 points 9 months ago

The browser extension also lets you scan the page for QR codes for the TOTP key.

[–] waspentalive@lemmy.world 1 points 9 months ago

But if they get your Bitwarden vault and crack it - they have everything Throw a roadblock in their way - use a separate app for OTP.