Why YSK: Because if you are like most people, you also store your email’s password in your Bitwarden Vault and not bother remembering it, causing you to potentially get locked out (since you wouldn’t be able to log in to your email to get the verification code, because your email’s password is in the vault itself 👀)
(Imagine leaving your key in your house, lol)
Source: https://bitwarden.com/help/new-device-verification/
Excerpt:
To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login. After entering your Bitwarden master password, you will be prompted to enter a one-time verification code sent to your account email to complete the login process when logging in from a device you have not logged in to previously. For example, if you are logging in to a mobile app or a browser extension that you have used before, you will not receive this prompt.
Good thing I noticed, otherwise I might’ve had a bad time next month 😖
Edit: Updated title to clarify that people who have 2FA are not affected.
My email is one of the few passwords I still know without my password manager.
It probably is time for me to rethink that 🤔
100%. Control of someones email is just about the #1 target for someone to breach. It not only gives someone a ton of data about you, its almost always the method companies use to reset passwords. Someone with full access to your email can wreck your day/month/year.
These are basically the same reasons I haven’t turned it over to my password manager.
A weak or reused password is much more dangerous than a secure password manager with mfa enabled.
🤨
…I will be sure to change all of my weak and/or reused passwords.
Thanks for the tip…
On the other hand, NOT using MFA on an online password manager is just poor opsec.
I understand that perspective, but honesly, for me, the threat of misplacing 2fa is higher than getting hacked.
People are “hacked” all the time in massive breaches. Its accelerating, not getting less likely. Password managers are a huge target, and have been breached in the past.
If youre worried about it, use something like Aegis. Its an mfa app that lets you easily save password protected backups. You can set it up to automatically save a copy to a folder on your phone. Then just copy that file off and store it somewhere safe.
If thats too much work and you dont run syncthing/nextcloud/etc, they also have an option to let it it sync with the google backup service.
The above gives you the best of both worlds : strong security and strong redundancy.
Where TOTP is concerned is you enroll multiple devices for redundancy, and there are scratch codes. Plus you’ll eventually be forced to resolve this issue when passkeys become more mainstream.
Happy to help or talk through things if you’d like a hand getting comfortable with MFA 🩵
I don’t like MFA. If the password/passphrase is strong enough, why need MFA? If its software MFA (like an app) a malware that could steal the password would also be capable of stealing the MFA.
If its hardware, one fire in my house, and all the keys are dead. (And I do not want to deal with a safe deposit box or burying the backup hardware keys in the woods somewhere, honestly, I don’t know where I would put the backup keys)
Edit: Lmfao MFA cultists be downvoting 🤣
I’m not even advocating against MFA, I just personally dislike it. Wtf y’all 🤣
I’m afraid I can’t help you with the ideological problem mate, only the practical one 😅 You’ve got sync or multiple devices, and you’ll have to pick 🤷
Please give MFA another look, it really is better security to use it.
The problems you mentioned: you keep the MFA backups in a password manager.
I know you’re worried about losing access to that password manager, use two different ones, write down your most important several passwords in a locked place, etc. it’s better.
I hate this so much. My Bitwarden password is the one thing I know. I’m not confident I could ever learn another password, especially one I barely ever need.
And 2FA? What if my phone breaks? My 2FA recovery codes are in Bitwarden.
Ugh. I have no idea what I’m going to do.
Print or write down your recovery codes, and stash them in a safe spot. And don’t store your primary email password in bitwarden either.
With your current setup, you’re one keylogger away from losing all your stuff.
Recovery codes. Take them seriously. Some I trust have them for glass break.
The amount of people not already using MFA in this thread is too damn high!
This is not the end of the world, some mighty overreaction on the comments. This is why diversity is the answer to security. Multi factor, multi mode, multi device. Something you know, something you have, something you are, etc.
If you have more than one device, like PCs, laptop, phone, in any combination, and you have your access config on all. Then there’s an infinitesimally small chance you’d lose access to your vault.
If you have more than one device
That’s the problem, many people only have one device. (My parents, grandparents, probably aunts and uncles all mostly use their phones, probably doesn’t have a second phone, or even touched a computer for a while, imagine if one of them used Bitwarden)
I personally haven’t used my PC for a while, since I don’t feel like playing games anymore, so most of my time using electronics is mostly doomscrolling Lemmy and watching Youtube (don’t judge). So if my phone happened to break, or if my app got corrupted for some reason and I had to re-download, I could definitely have gotten locked out, but luckily I saw that notice, I have the Email password saved in Keepass, so now that threat is over).
(I know I should’ve backup the vault, but I kinda procrastinated 🙃)
PSA: Vaultwarden is easy to self host.
Thanks for the heads up, though this would be less of an issue if you have the email app on your phone or the tab pinned in Firefox.
The real issue is i gotta use another authentication app for my email now, have been using Bitwarden itself for 2fa codes for proton. Definitely can’t use proton pass to 2fa for my proton account.
I don’t even know. Gonna have to find another reputable authenticator app.
Guess I should also check if Bitwarden or proton support physical security keys. Would be pretty bomb proof since my keys are always in my pocket anyway.
Aegis is a good Authenticator app you could consider
Generally, it’s not recommended to keep TOTP and passwords at the same place
This introduces so many failure modes. What if my email provider goes bankrupt, or fucks up their servers, or bans me? Access to my Bitwarden Vault is now dependent on some company’s whims
I mean, you could set up 2FA and save the QR code that you used to set up the 2FA in unencrypted format on some cloud, making it a de facto 1FA. That could be the workaround if you just refuse to use 2FA.
Or you could just move to Keepass like I’m planning to do.
This is only for devices you haven’t logged in from before.
I liked the thought that if I were to lose my phone while traveling, I could just borrow a computer and access all my accounts anyway and not getting very uncomfortably stuck. This is putting me at big risk there.
there will be an option to turn it off, so no worries
