Why YSK: Because if you are like most people, you also store your email’s password in your Bitwarden Vault and not bother remembering it, causing you to potentially get locked out (since you wouldn’t be able to log in to your email to get the verification code, because your email’s password is in the vault itself 👀)
(Imagine leaving your key in your house, lol)
Source: https://bitwarden.com/help/new-device-verification/
Excerpt:
To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login. After entering your Bitwarden master password, you will be prompted to enter a one-time verification code sent to your account email to complete the login process when logging in from a device you have not logged in to previously. For example, if you are logging in to a mobile app or a browser extension that you have used before, you will not receive this prompt.
Good thing I noticed, otherwise I might’ve had a bad time next month 😖
Edit: Updated title to clarify that people who have 2FA are not affected.
The amount of people not already using MFA in this thread is too damn high!
I wish that we could use same MFA more often! My bank can get outa here with that texting me a code bullshit. Let me use a rotating key!
100%. It’s crazy that banks haven’t caught up with the times.
This is a good thing. Any account you care about and don’t want to be accessed by anyone without your consent should have multifactor authentication enabled. Use an app like Google Authenticator or a hardware token like a Yubikey. 2FA through text or email is insecure and easily bypassed.
Friends don’t let friends raw dog the internet. Don’t be dumb and get your shit stolen. Use MFA everywhere.
Cant wait for someone to use bitwarden to store their bitwarden 2FA codes and recovery codes, thus locking themselves out of their account.
This is just a dumb move by bitwarden.
Multi device. If you have more than one device with your vault configured and protected with MFA then the risk of locking yourself out of the account drops logarithmically with each additional device.
When they turn this on, all your devices will have to reauthenticate simultaneously. There are absolutely going to be some people who get locked out when this goes live, which could be just as bad as an attacker gaining your credentials.
Oh dear lord, no. That’s absolutely wrong. Stop panicking and read.
if you are logging in to a mobile app or a browser extension that you have used before, you will not receive this prompt
My email is one of the few passwords I still know without my password manager.
It probably is time for me to rethink that 🤔
If I was in a coma for five years and woke up, I’d still remember my 40-something character password manager password. I should do the same thing for my E-mail.
“who do not use two-step login”
Enough people that they decided to make this mandatory.
So, probably a lot.
This is not the end of the world, some mighty overreaction on the comments. This is why diversity is the answer to security. Multi factor, multi mode, multi device. Something you know, something you have, something you are, etc.
If you have more than one device, like PCs, laptop, phone, in any combination, and you have your access config on all. Then there’s an infinitesimally small chance you’d lose access to your vault.
If you have more than one device
That’s the problem, many people only have one device. (My parents, grandparents, probably aunts and uncles all mostly use their phones, probably doesn’t have a second phone, or even touched a computer for a while, imagine if one of them used Bitwarden)
I personally haven’t used my PC for a while, since I don’t feel like playing games anymore, so most of my time using electronics is mostly doomscrolling Lemmy and watching Youtube (don’t judge). So if my phone happened to break, or if my app got corrupted for some reason and I had to re-download, I could definitely have gotten locked out, but luckily I saw that notice, I have the Email password saved in Keepass, so now that threat is over).
(I know I should’ve backup the vault, but I kinda procrastinated 🙃)
They have different threat models. If they don’t have a PC, they most likely don’t and never will have bitwarden. They’ll let apple or Samsung or Google handle their security for them. In the end, we all accept some level of risks across different threat dimensions. Some people are more lax and some people are more strict. It’s not the end of the world.
Guess its time to set up a hardware key
I’ll probably move to Keepass, I like to have control over my vault file, probably better than whatever “2fa” they are forcing anyways, since only I know where the vault is at.
Already store the most critical stuff in keepass; use bitwarden for the lower-risk stuff that benefits from the higher convenience factor.
Also, I’m not sure if anyone else get any notice, but in my experience I didn’t even get a notice in my email at all. I just went to the browser page moments ago and saw the notice. I was like “WTF”. I logged in a few days ago on the 22nd and didn’t see that, so this must be recent. Less than 10 days of notice? Wtf Bitwarden?!?
(I don’t currently use 2fa because I have trouble with misplacing 2fa stuff, so I’m more likely to get myself locked out with 2fa, than having someone hack my vault without 2fa.)
Are you able to remember a strong password? If you can then you can use something like KeePass, it is an offline password manager (and authenticator) that you can use on your phone and PC and backup the file anyway you want, in storage and the cloud. It is very easy to import and export.
Use the 3-2-1 rule for storing your vault:
Maintain three copies of your data: This includes the original data and at least two copies.
Use two different types of media for storage: Store your data on two distinct forms of media to enhance redundancy.
Keep at least one copy off-site: To ensure data safety, have one backup copy stored in an off-site location, separate from your primary data and on-site backups.
I have a Bitwarden vault for passwords and a KeePass vault for TOTP. I would use at least 2 Yubikeys as well but I’m using degoogled Grapheneos. I hate email and SMS verification for MFA, and my stupid banks only support these two methods.
I don’t see anyone mentioning it, but what if you do forget (or don’t know) your email password? Is there absolutely no way to recover your account? I’m sure there might be some services that are that restrictive, but I’d think that most are recoverable with some extra steps, no? Unless I’m missing something?
I don’t know, they haven’t implemented it yet.
I hope that if enough people started to get locked out, they will reverse or delay it for a few months and give people time to access the vault and make preparations.
Since you are seeing my post, you know this is happeneing, so you should probably change your email password to something memorable.
Or put that in a Keepass vault, and remember the Keepass password, and back up the vault to multiple cloud accounts, multiple Hard Drives / SSDs, etc. (I had this done just before I posted this post)
Or just move entirely to Keepass, like I’m planning to do.
The only two passwords I know are my Bitwarden’s and my Email’s.
Why would they ever force this?
The purpose of MFA is to:
Mitigate using the same password on multiple sites and one of them has a data breach.
Mitigate the impact of keyloggers/other kinds of malware.
Mitigate the bad security of bad passwords.
Mitigate the password manager’s own data breach.
If you have at least two braincells, you will chose a unique and secure password for your password manager. That’s the point of password managers, that you only have to remember 1 password so it can be unique and strong. Also, a password manager (specially open source) should have almost perfect security, so them being hacked should not be a concern.
The only thing MFA is doing on password managers is to mitigate malware. Which I don’t think is a good justification to force everyone the hassle of MFA.
Fine if the wanna give the option of MFA, but don’t force it on everyone.
I mean, I don’t necessarily oppose it, I just hate how they never gave any notices until like Jan 27, 2025 (according to this article: https://bitwarden.com/blog/adding-more-security-to-bitwarden-user-accounts/ look at the date on it).
They should’ve given at least 3 months notice for such a drastic change like this. I feel like there would be a lot of people getting locked out because they didn’t know about this.
