On the other hand, NOT using MFA on an online password manager is just poor opsec.
this post was submitted on 28 Jan 2025
272 points (96.9% liked)
You Should Know
33881 readers
168 users here now
YSK - for all the things that can make your life easier!
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must begin with YSK.
All posts must begin with YSK. If you're a Mastodon user, then include YSK after @youshouldknow. This is a community to share tips and tricks that will help you improve your life.
Rule 2- Your post body text must include the reason "Why" YSK:
**In your post's text body, you must include the reason "Why" YSK: Itβs helpful for readability, and informs readers about the importance of the content. **
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding non-YSK posts.
Provided it is about the community itself, you may post non-YSK posts using the [META] tag on your post title.
Rule 7- You can't harass or disturb other members.
If you harass or discriminate against any individual member, you will be removed.
If you are a member, sympathizer or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people and you were provably vocal about your hate, then you will be banned on sight.
For further explanation, clarification and feedback about this rule, you may follow this link.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- The majority of bots aren't allowed to participate here.
Unless included in our Whitelist for Bots, your bot will not be allowed to participate in this community. To have your bot whitelisted, please contact the moderators for a short review.
Rule 11- Posts must actually be true: Disiniformation, trolling, and being misleading will not be tolerated. Repeated or egregious attempts will earn you a ban. This also applies to filing reports: If you continually file false reports YOU WILL BE BANNED! We can see who reports what, and shenanigans will not be tolerated.
Partnered Communities:
You can view our partnered communities list by following this link. To partner with our community and be included, you are free to message the moderators or comment on a pinned post.
Community Moderation
For inquiry on becoming a moderator of this community, you may comment on the pinned post of the time, or simply shoot a message to the current moderators.
Credits
Our icon(masterpiece) was made by @clen15!
founded 2 years ago
MODERATORS
I understand that perspective, but honesly, for me, the threat of misplacing 2fa is higher than getting hacked.
People are "hacked" all the time in massive breaches. Its accelerating, not getting less likely. Password managers are a huge target, and have been breached in the past.
If youre worried about it, use something like Aegis. Its an mfa app that lets you easily save password protected backups. You can set it up to automatically save a copy to a folder on your phone. Then just copy that file off and store it somewhere safe.
If thats too much work and you dont run syncthing/nextcloud/etc, they also have an option to let it it sync with the google backup service.
The above gives you the best of both worlds : strong security and strong redundancy.
Where TOTP is concerned is you enroll multiple devices for redundancy, and there are scratch codes. Plus you'll eventually be forced to resolve this issue when passkeys become more mainstream.
Happy to help or talk through things if you'd like a hand getting comfortable with MFA π©΅
load more comments
(3 replies)
The amount of people not already using MFA in this thread is too damn high!
I hate this so much. My Bitwarden password is the one thing I know. I'm not confident I could ever learn another password, especially one I barely ever need.
And 2FA? What if my phone breaks? My 2FA recovery codes are in Bitwarden.
Ugh. I have no idea what I'm going to do.
I can tell you what most are going to do. Same password for both the vault and the email provider. Which is counter productive to everything.
Print or write down your recovery codes, and stash them in a safe spot. And don't store your primary email password in bitwarden either.
With your current setup, you're one keylogger away from losing all your stuff.
load more comments
(3 replies)
Using different apps for password management and for 2fa is good for your security and good for redundancy. If your vault is compromised, you don't want your OTP info compromised with it. I personally use Aegis.
That said, Aegis is still an Android app and while I have a backup of it's data, I think I'm still out of luck if my phone breaks until it gets repaired or replaced. I've been trying to figure that one out, because it doesn't seem like there's a lot of good options with desktop support.
Maybe you could use an Android VM and install Aegis into it
Option 1: Set Email password same as Bitwarden Password (probably not a good idea, but technically an option π)
Option 2: Make a Keepass Vault with the same password as Bitwarden, and put your Email password in it. Make sure to backup the keepass vault file to many different Hard Drives, SDDs, and cloud (file is encrypted so its probably safe in cloud)
Option 3: Move every password into Keepass.
Hurry, time is ticking, February is in a few days. (I'm moving to Keepass btw, already have my Email password in Keepass and the vault is backed up)
I've never used bit warden, but I migrated from Nordpass to keepass, I currently use a private key for my second form of Authentication so even if my vault is stolen it can't be decrypted cuz they would need the private key along with it
It's a stupid simple setup, because I use syncthing to synchronize my Vault across all systems, and I have syncthing set up that way it keeps three or four versions of the Vault active at a time so if I somehow managed to corrupt The Vault I can just use an older version, this way I only have one account that I'm locked out of instead of all accounts.
As for 2fa, yeah I do the same thing as the other guy my 2fa is stored in my vault. I used to use authy for everything, then they decided that it wasn't secure to have a desktop app, and since I don't have my phone on me at all times I decided just fuck it and threw it all in one location. It's less secure but there isn't a decent desktop 2fa app available that I know of. Technically I could make a seperate keepass vault only for 2fa but that would be a second password to remember
Recovery codes. Take them seriously. Some I trust have them for glass break.
This is a good thing. Any account you care about and donβt want to be accessed by anyone without your consent should have multifactor authentication enabled. Use an app like Google Authenticator or a hardware token like a Yubikey. 2FA through text or email is insecure and easily bypassed.
Friends donβt let friends raw dog the internet. Donβt be dumb and get your shit stolen. Use MFA everywhere.
load more comments
(5 replies)
This is likely timed to meet the new PCI requirements, since they are designed to store your credit card info if you want to, and MFA will be a requirement as of April 1st this year. Everyone should be using MFA for this kind of information anyway, I know people hate inconvenience in the name of security, but if safety wasn't forced on people we wouldn't have things like seat belts, hand rails, and factory safety lockouts.
but if safety wasnβt forced on people we wouldnβt have things like seat belts, hand rails, and factory safety lockouts.
But like... They just posted the announcement on Jan 27. I literally didn't get any notice before that, and I still have yet to receive a notice via email, only knew because I was logging in via the web. (Did anyone else even get a notice?)
They should've given at least 3 month notice in advance for such a drastic change that could potentially get someone locked out.
They should've given at least 3 month notice in advance for such a drastic change that could potentially get someone locked out.
Absolutely. Their Lawyer/Risk/Compliance person probably just noticed and went "oh fuck". With the short timeline they gave vs. compliance effect date, I hope it means they will have all hands on deck to support and work around the inevitable lockouts next month.
load more comments
(1 replies)
I'm getting sick of all this two step verification and code confirmation bullshit. I don't need my Instagram password stored in a bank vault with 24 hour security. Let me opt out of all this extra security and if it gets breached then blame me for opting out.
I don't even have two step verification turned on for something and I still needed to check my email for a code and then when logging into the email I needed to check my phone for a second code just so I could access the first code for some bullshit account I hardly ever use. It's incredibly frustrating.
If I want to go through all that shit for security purposes then I will ask you to go through all those steps. Don't force me to. Fuck.
It's because PCI requirements, they offer to store credit card information and PCI compliance now requires that be under a 2FA. Also honestly, you should be using 2FA regardless, make it less annoying by using a proper token Authenticator. Authy is a decent one, avoid Google Authenticator bit Warden also offers a separate program for token Authentication that you can use on your phone.
Tokens are still an extra step but less annoying than having to go check your email for a code. Or you can go the extra mile and purchase something like a yubikey, all you have to do is have it plugged into a computer USB port and it will handle the two-factor for you automatically
I don't use bit warden but, that sounds like a flaw that can very easily fuck your system up.
I find it stupid as a mandatory requirement, if you don't want to use 2fa then you should be allowed not to, it's still a multitude better than just using the same password for everything of having it on a text document on your computer.
The only two passwords I know are my Bitwarden's and my Email's.
Thank-you. Made me check my shit.
Just a reminder that most of us have backups of the vault. It's not like the apocalypse.
This is stupid.. Now where would i save my mail password
@OP There will be an option to turn it off, maybe add that to the post
An option to turn off new device login protection will be available in the web vault account settings
Anyways thank you so much OP for notifying me, their fuckup would've impacted me as well
This is not the end of the world, some mighty overreaction on the comments. This is why diversity is the answer to security. Multi factor, multi mode, multi device. Something you know, something you have, something you are, etc.
If you have more than one device, like PCs, laptop, phone, in any combination, and you have your access config on all. Then there's an infinitesimally small chance you'd lose access to your vault.
If you have more than one device
That's the problem, many people only have one device. (My parents, grandparents, probably aunts and uncles all mostly use their phones, probably doesn't have a second phone, or even touched a computer for a while, imagine if one of them used Bitwarden)
I personally haven't used my PC for a while, since I don't feel like playing games anymore, so most of my time using electronics is mostly doomscrolling Lemmy and watching Youtube (don't judge). So if my phone happened to break, or if my app got corrupted for some reason and I had to re-download, I could definitely have gotten locked out, but luckily I saw that notice, I have the Email password saved in Keepass, so now that threat is over).
(I know I should've backup the vault, but I kinda procrastinated π)
They have different threat models. If they don't have a PC, they most likely don't and never will have bitwarden. They'll let apple or Samsung or Google handle their security for them. In the end, we all accept some level of risks across different threat dimensions. Some people are more lax and some people are more strict. It's not the end of the world.
This introduces so many failure modes. What if my email provider goes bankrupt, or fucks up their servers, or bans me? Access to my Bitwarden Vault is now dependent on some company's whims
load more comments
(5 replies)
My email is one of the few passwords I still know without my password manager.
It probably is time for me to rethink that π€
100%. Control of someones email is just about the #1 target for someone to breach. It not only gives someone a ton of data about you, its almost always the method companies use to reset passwords. Someone with full access to your email can wreck your day/month/year.
load more comments
(3 replies)
load more comments
(1 replies)
To be fair your post title does not match their own text
To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login.
So it's not all accounts, just the ones that don't already have 2FA. Personally I wouldn't have noticed any changes since I already use 2FA enabled with an authenticator app. But I can see how this might bite you in the ass if you weren't already using 2FA.
Interestingly I used to run into a similar issue when using Lastpass. When logging in from other IP addresses they would often do mandatory email 2FA, and of course I couldn't get into the email account without Lastpass. But it sort of resolved itself since I also have email on my phone so I just had to make sure those Lastpass emails didn't end up in spam or wherever.
I just got a pop-up about this today... It would have been nice to get this at the beginning of the month......
What if you host via Vaultwarden? Do you have control over it?
Who is excluded from this account email-based new device verification?
The following categories of logins are excluded:
Users who have two-step login set up are excluded.
Users who log in with SSO, a passkey, or with an API key are excluded.
Self-hosted users are excluded.
Users who log in from a device where they have previously logged in are excluded.
load more comments
(2 replies)
Thanks for the heads up, though this would be less of an issue if you have the email app on your phone or the tab pinned in Firefox.
The real issue is i gotta use another authentication app for my email now, have been using Bitwarden itself for 2fa codes for proton. Definitely canβt use proton pass to 2fa for my proton account.
I donβt even know. Gonna have to find another reputable authenticator app.
Guess I should also check if Bitwarden or proton support physical security keys. Would be pretty bomb proof since my keys are always in my pocket anyway.
Aegis is a good Authenticator app you could consider
Generally, it's not recommended to keep TOTP and passwords at the same place
load more comments
(1 replies)
load more comments
(1 replies)
Also, I'm not sure if anyone else get any notice, but in my experience I didn't even get a notice in my email at all. I just went to the browser page moments ago and saw the notice. I was like "WTF". I logged in a few days ago on the 22nd and didn't see that, so this must be recent. Less than 10 days of notice? Wtf Bitwarden?!?
(I don't currently use 2fa because I have trouble with misplacing 2fa stuff, so I'm more likely to get myself locked out with 2fa, than having someone hack my vault without 2fa.)
load more comments
(2 replies)
view more: next βΊ