What they’re saying is that if all of the multiple factors are stored behind 1 master password in 1 service, the whole purpose of MFA is negated. You’ve just shifted the single point of failure from a website password to your Bitwarden master password.
You’re not wrong at all that it’s still more secure than most. But it’s still not mfa in that case unless you have separate mfa to get into Bitwarden/LastPass/etc, THEN you could make an argument that it’s mfa by proxy.
The second you put totp codes into bitwarden, it’s no longer mfa.
Also, it can still be MFA which is the way I use it.
What they’re saying is that if all of the multiple factors are stored behind 1 master password in 1 service, the whole purpose of MFA is negated. You’ve just shifted the single point of failure from a website password to your Bitwarden master password.
True, but to access bitwarden you need a device already logged in to bitwqrden or the TOTP for bitwarden, so effectively overly 2FA.
Also, the purpose of a password manager is unique secure passwords, so most users start off more secure.
You’re not wrong at all that it’s still more secure than most. But it’s still not mfa in that case unless you have separate mfa to get into Bitwarden/LastPass/etc, THEN you could make an argument that it’s mfa by proxy.
A seperate 2fa is the default for bitwarden. It used to not be but was changed about 6-12 months ago.
This is what I do. It’s fine for me. I know how to do this more safely than the average person by far.
I do it to, bit it’s not mfa at that point because you have a single point of failure/compromise
It’s intentional, actually, that way I can recover my data as easily as possible. I know how to do this safely.