I want to use a hardware key to secure my Bitwarden vault and I came across the following thread online:

The user asked:
I want to move to using a yubikey to unlock my vault and was thinking that if I do that I can safely store my TOTP codes in BitWarden and then my TOTP codes would not be tied to a phone app. Is there guidance around this sort of behavior?



Another user responded:

While there are theoretical risks to using Bitwarden Authenticator, these risks are minuscule is you keep your devices physically secure, practice good internet hygiene, have a strong, unique master password and 2FA for Bitwarden.

Conversely, there are significant benefits to using the Bitwarden Authenticator for TOTP, including cross-platform syncing, and the automatic copying of TOTP codes after each autofill event.

My personal recommendation would be to set up Webauthn/FIDO2 as the 2FA for any site that allows it (including Bitwarden), and use Bitwarden Authenticator for the rest. However, as others have mentioned, depending on which YubiKey model you get, some of them have the ability to produce their own TOTP codes for up to 32 different websites. With this option, if you have sensitive/valuable login accounts (banks, etc.) that do not offer the ability to set up 2FA by Webauthn/FIDO2, then using Yubico Authenticator instead of Bitwarden Authenticator for those specific accounts would provide some enhanced security.

Since you're asking for best practices, you should get at least one extra YubiKey to serve as a backup key, as every website does not offer 2FA recovery codes. Also, if you set up Webauthn/FIDO2 on any website that does offer 2FA recovery codes, then do not store those recovery codes in your Bitwarden vault (as this would negate the benefit of using Webauthn/FIDO2 over Bitwarden Authenticator).



In this thread, there are many words and concepts thrown around that I don't know. Can you please break down all the technical terms and concepts and explain them to me?