Why YSK: Because if you are like most people, you also store your email’s password in your Bitwarden Vault and not bother remembering it, causing you to potentially get locked out (since you wouldn’t be able to log in to your email to get the verification code, because your email’s password is in the vault itself 👀)
(Imagine leaving your key in your house, lol)
Source: https://bitwarden.com/help/new-device-verification/
Excerpt:
To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login. After entering your Bitwarden master password, you will be prompted to enter a one-time verification code sent to your account email to complete the login process when logging in from a device you have not logged in to previously. For example, if you are logging in to a mobile app or a browser extension that you have used before, you will not receive this prompt.
Good thing I noticed, otherwise I might’ve had a bad time next month 😖
Edit: Updated title to clarify that people who have 2FA are not affected.
“who do not use two-step login”
deleted by creator
They should be using 2FA then. There are at least 3 other multifactor authentication options available. Configure one of them, or you can be affected by the device verification change. Or, you can disable the feature, but without any secondary auth factor, you’re just begging to have your passwords stolen.
How the fuck am I supposed to use 2FA when BW stores my email password?
This is like them saying giving up and making your email the actual password manager.
I need a local password manager that just works when everything else is down.
https://www.makeuseof.com/bitwarden-email-2fa/
This may sound handy initially, but it poses a problem for people who store their email passwords in Bitwarden. It creates a nasty catch-22 where they need to access their email to get their Bitwarden login code, but they need to access Bitwarden to get their email password.
To prevent this from happening, Bitwarden advises that you make a memorable password for your email account, then add a 2FA layer onto it so people can’t access your inbox.
Their solution is totally ass: “just remember TWO master passwords”
There are at least three other MFA methods that are not email based, and so no, you don’t have to remember your email password.
Get an authenticator app. Get an authenticator key. Or hell, go use Duo for free (not recommended). And if none of those do it for you, use your 2FA recovery code. That’s what it exists for.
And if all else fails, you can still shoot yourself in the foot and opt out of the change, but you’re just begging to have your passwords stolen ¯_(ツ)_/¯
On the other hand, NOT using MFA on an online password manager is just poor opsec.
deleted by creator
Sorry dude, if keeping your 2fa codes safe is too much to ask then you really shouldn’t be on the internet.
Using a password manager without 2fa is a recipe for disaster, you might as well just use the same password for all your accounts at that point, then you don’t need the inconvenience of a password manager
deleted by creator
People are “hacked” all the time in massive breaches. Its accelerating, not getting less likely. Password managers are a huge target, and have been breached in the past.
If youre worried about it, use something like Aegis. Its an mfa app that lets you easily save password protected backups. You can set it up to automatically save a copy to a folder on your phone. Then just copy that file off and store it somewhere safe.
If thats too much work and you dont run syncthing/nextcloud/etc, they also have an option to let it it sync with the google backup service.
The above gives you the best of both worlds : strong security and strong redundancy.
Where TOTP is concerned is you enroll multiple devices for redundancy, and there are scratch codes. Plus you’ll eventually be forced to resolve this issue when passkeys become more mainstream.
Happy to help or talk through things if you’d like a hand getting comfortable with MFA 🩵
deleted by creator
Please give MFA another look, it really is better security to use it.
The problems you mentioned: you keep the MFA backups in a password manager.
I know you’re worried about losing access to that password manager, use two different ones, write down your most important several passwords in a locked place, etc. it’s better.
I’m afraid I can’t help you with the ideological problem mate, only the practical one 😅 You’ve got sync or multiple devices, and you’ll have to pick 🤷
My email is one of the few passwords I still know without my password manager.
It probably is time for me to rethink that 🤔
100%. Control of someones email is just about the #1 target for someone to breach. It not only gives someone a ton of data about you, its almost always the method companies use to reset passwords. Someone with full access to your email can wreck your day/month/year.
These are basically the same reasons I haven’t turned it over to my password manager.
A weak or reused password is much more dangerous than a secure password manager with mfa enabled.
🤨
…I will be sure to change all of my weak and/or reused passwords.
Thanks for the tip…
This is a good thing. Any account you care about and don’t want to be accessed by anyone without your consent should have multifactor authentication enabled. Use an app like Google Authenticator or a hardware token like a Yubikey. 2FA through text or email is insecure and easily bypassed.
Friends don’t let friends raw dog the internet. Don’t be dumb and get your shit stolen. Use MFA everywhere.
Cant wait for someone to use bitwarden to store their bitwarden 2FA codes and recovery codes, thus locking themselves out of their account.
This is just a dumb move by bitwarden.
I’m fine, I use Aegis to store my bitwarden 2FA code. I just need my Aegis password to access it that is stored in … Bitwarden …
I might not be the sharpest egg in the basket, thanks OP to have made me realize my mistake and I’ll change that.
Multi device. If you have more than one device with your vault configured and protected with MFA then the risk of locking yourself out of the account drops logarithmically with each additional device.
When they turn this on, all your devices will have to reauthenticate simultaneously. There are absolutely going to be some people who get locked out when this goes live, which could be just as bad as an attacker gaining your credentials.
Oh dear lord, no. That’s absolutely wrong. Stop panicking and read.
if you are logging in to a mobile app or a browser extension that you have used before, you will not receive this prompt
something done by many services, sites, and games.
but yea, i get it. the problem of asking someone to login to a service that they (bw) are holding your key for, in order for you to get into where that key is held.
deleted by creator
Just use something like ente auth, then you can just login online anytime and get your 2fa codes.
Are you able to remember a strong password? If you can then you can use something like KeePass, it is an offline password manager (and authenticator) that you can use on your phone and PC and backup the file anyway you want, in storage and the cloud. It is very easy to import and export.
Use the 3-2-1 rule for storing your vault:
Maintain three copies of your data: This includes the original data and at least two copies.
Use two different types of media for storage: Store your data on two distinct forms of media to enhance redundancy.
Keep at least one copy off-site: To ensure data safety, have one backup copy stored in an off-site location, separate from your primary data and on-site backups.
I have a Bitwarden vault for passwords and a KeePass vault for TOTP. I would use at least 2 Yubikeys as well but I’m using degoogled Grapheneos. I hate email and SMS verification for MFA, and my stupid banks only support these two methods.
Thanks for the heads up, though this would be less of an issue if you have the email app on your phone or the tab pinned in Firefox.
The real issue is i gotta use another authentication app for my email now, have been using Bitwarden itself for 2fa codes for proton. Definitely can’t use proton pass to 2fa for my proton account.
I don’t even know. Gonna have to find another reputable authenticator app.
Guess I should also check if Bitwarden or proton support physical security keys. Would be pretty bomb proof since my keys are always in my pocket anyway.
Bitwarden supports phys. keys but you have to pay for the premium subscription to use them, which is 10$/year
Aegis is a good Authenticator app you could consider
Generally, it’s not recommended to keep TOTP and passwords at the same place
Guess its time to set up a hardware key
deleted by creator
Already store the most critical stuff in keepass; use bitwarden for the lower-risk stuff that benefits from the higher convenience factor.
I mean, if they’re forcing 2FA at all, that’s a good thing, but they still have the usual TOTP and hardware key options.
Anyway, I understand why people would want to host their own vault file. Just remember that obfuscation (i.e. being the only one who knows where your vault is) isn’t a viable security method. Removing access to potential thieves is.
The only two passwords I know are my Bitwarden’s and my Email’s.
I’m getting sick of all this two step verification and code confirmation bullshit. I don’t need my Instagram password stored in a bank vault with 24 hour security. Let me opt out of all this extra security and if it gets breached then blame me for opting out.
I don’t even have two step verification turned on for something and I still needed to check my email for a code and then when logging into the email I needed to check my phone for a second code just so I could access the first code for some bullshit account I hardly ever use. It’s incredibly frustrating.
If I want to go through all that shit for security purposes then I will ask you to go through all those steps. Don’t force me to. Fuck.
It’s because PCI requirements, they offer to store credit card information and PCI compliance now requires that be under a 2FA. Also honestly, you should be using 2FA regardless, make it less annoying by using a proper token Authenticator. Authy is a decent one, avoid Google Authenticator bit Warden also offers a separate program for token Authentication that you can use on your phone.
Tokens are still an extra step but less annoying than having to go check your email for a code. Or you can go the extra mile and purchase something like a yubikey, all you have to do is have it plugged into a computer USB port and it will handle the two-factor for you automatically
I just got a pop-up about this today… It would have been nice to get this at the beginning of the month…
Thank-you. Made me check my shit.
Just a reminder that most of us have backups of the vault. It’s not like the apocalypse.
For what it’s worth, as of a minute ago the form that’s for sending the email code asks if you have reliable access to the email before sending the code.
But otherwise seems to be a non-issue with any of the software/hardware mfa options it supports. Good to let others know about this though!
To be fair your post title does not match their own text
To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login.
So it’s not all accounts, just the ones that don’t already have 2FA. Personally I wouldn’t have noticed any changes since I already use 2FA enabled with an authenticator app. But I can see how this might bite you in the ass if you weren’t already using 2FA.
Interestingly I used to run into a similar issue when using Lastpass. When logging in from other IP addresses they would often do mandatory email 2FA, and of course I couldn’t get into the email account without Lastpass. But it sort of resolved itself since I also have email on my phone so I just had to make sure those Lastpass emails didn’t end up in spam or wherever.
PSA: Vaultwarden is easy to self host.
Absolutely, but this is one of the worst reasons to advocate self-hosting a service. The kinds of people that are upset about higher security standards should not be self-hosting anything.
I just setup vaultwarden a few days ago for a small group, it’s very simple.
