I understand why they're doing this but if I was okay with Google being able to lock me out of my password manager then I would simply be using Google's password manager already
I don't use a gmail domain email for Bitwarden. So I can host that email address elsewhere, at some point...sure is inconvenient and difficult to migrate away from all that Google & Android stuff tho...
@johnefrancis Something has to be at the root. If I self host a domain I have to worry what happens if that domain stops working and I need to use email 2FA to fix the domain.
I want 3-4 hardware keys as the roots. Keep one out for regular use, the rest distributed in safes. If I lose the safe combination, I can pay a locksmith to open it. I can put a hardware key in a safety deposit box.
I recently switched devices and encountered this, and I was just mentioning the encrypted credentials problem for backups when your credentials are encrypted in the backup so decrypting or accessing the backup…
The problem is some form of 2FA does seem like a good idea. I wonder if there's a way to get some of the benefits without adding hard gmail failure points.
@gord I am considering suggesting as a third option offering a "reverse 2FA" option:
- You attempt to log in - A 2FA email is sent - If the email results in "approve", you are let in - If the email does *not* result in "disapprove" within 24-48 hours, you are let in anyway
This could help with catastrophe scenarios while creating only limited risk of a Problem
@gord isn't it how the emergency access work for BW? When I set it up I'm pretty sure it was how it was setup, maybe minus the approve part before the end of the delay.
Now that said, is there a reason you don't want to do regular 2FA through an authenticator app? That seems like a secure enough option. Print off the backup codes and keep them safe in case you lost your device.
Bitwarden Password Manager can be hooked up to Bitwarden Authenticator to do 2FA, in which case they do not do the email authentication part (if I'm reading all this correctly). The email part is only if you use the password manager without 2FA.
When you hook the authenticator app up, you get a bunch of backup codes, you print those off and save them somewhere very safe. Those are your safety net. With those you can lose all your devices and still be OK.
I got this and had the same reaction... Wondering what is the 2 step login alternative they offer there... But it's definitely a weird loop to be in if your email password is in bitwarden in the first place
I feel very strongly that a credential manager, or really any sort of secure secret store, should not have a dependency on a third party, never mind a completely open-ended third party category like "any user's email provider"
@jantzen Is your suggestion that I set up Bitwarden to only let me log in on a new device if I TOTP authenticate on a second, existing Bitwarden device?
in principle, I think you’re supposed to have a separate password manager and TOTP authenticator, since otherwise you’re reducing your two factors to one. I don’t really know how much that matters, or what considerations your threat model makes about a breach of your password manager
@shadowfacts @jantzen well, in the scenario under discussion (logging in to bitwarden on a new device) isn't their concern that it's currently 0 programs on my phone? All that's needed is my master password.
As I read their announcement, if one has some non-email 2FA set up already, then the new email based 2FA is not required, right?
John Francis 🇨🇦🦫🍁💪⬆️
in reply to mcc • • •mcc
in reply to John Francis 🇨🇦🦫🍁💪⬆️ • • •John Francis 🇨🇦🦫🍁💪⬆️
in reply to mcc • • •mcc
Unknown parent • • •Dragon-sided D
in reply to mcc • • •Henri
in reply to mcc • • •New fear unlocked.
Gotta start making backups of my passwords now, I guess.
mcc
in reply to Henri • • •Henri
in reply to mcc • • •Export .json, .csv, .json (encrypted)
But how to automate it...
Gotta hope that when I need my email password now on a new device that I also have a device handy where I logged in before.
Dan Hugo
in reply to Henri • • •@slyecho
bitwarden.com/help/cli/
bw login, export…
I use this now and then, similar to pass, which I use often.
I too am dismayed that additional “features” get added with a little “Surprise!” element to them 🫤
mcc
in reply to Dan Hugo • • •Dan Hugo
in reply to mcc • • •@slyecho
Another blinking light to pay attention to…
I recently switched devices and encountered this, and I was just mentioning the encrypted credentials problem for backups when your credentials are encrypted in the backup so decrypting or accessing the backup…
As long as it keeps my SSN safe from hackers
Dan Hugo
in reply to mcc • • •@slyecho
Received email notification this morning from Bitwarden regarding new login procedure.
Gordon Little
in reply to mcc • • •mcc
in reply to Gordon Little • • •@gord Thank you.
The problem is some form of 2FA does seem like a good idea. I wonder if there's a way to get some of the benefits without adding hard gmail failure points.
mcc
in reply to mcc • • •@gord I am considering suggesting as a third option offering a "reverse 2FA" option:
- You attempt to log in
- A 2FA email is sent
- If the email results in "approve", you are let in
- If the email does *not* result in "disapprove" within 24-48 hours, you are let in anyway
This could help with catastrophe scenarios while creating only limited risk of a Problem
Thibug
in reply to mcc • • •Gordon Little
in reply to mcc • • •That is a good idea.
Now that said, is there a reason you don't want to do regular 2FA through an authenticator app? That seems like a secure enough option. Print off the backup codes and keep them safe in case you lost your device.
mcc
in reply to Gordon Little • • •Gordon Little
in reply to mcc • • •mcc
in reply to Gordon Little • • •Gordon Little
in reply to mcc • • •D2
in reply to mcc • • •mcc
in reply to D2 • • •Man aging with dogs
in reply to mcc • • •Leo Ré Jorge
in reply to mcc • • •jcoglan
in reply to mcc • • •Alison
in reply to mcc • • •mcc
Unknown parent • • •mcc
in reply to mcc • • •mcc
Unknown parent • • •Harvey Lemmings
in reply to mcc • • •D2
in reply to mcc • • •mcc
in reply to D2 • • •@cascheranno it can be turned off peoplemaking.games/@gord/11394…
Gordon Little
2025-02-04 17:16:30
Emile Snyder
in reply to mcc • • •@shadowfacts @jantzen well, in the scenario under discussion (logging in to bitwarden on a new device) isn't their concern that it's currently 0 programs on my phone? All that's needed is my master password.
As I read their announcement, if one has some non-email 2FA set up already, then the new email based 2FA is not required, right?