Hacker News Reader

Comment by sesky | Hacker News Reader

Agreed. There is no way to rely on the simple model of 'my master password is the single point of failure' now. With any form of 2FA, there is now lockout risk in a way that cannot be mitigated fully. Bitwarden itself recommends printing out a recovery code and storing it in a safe, but what happens if you lose access to that safe? Or if you're traveling and need emergency access to your accounts after your phone gets stolen?

On the reddit post announcing this, Bitwarden added a response saying they will provide an opt-out option. It's unclear if this opt-out is temporary or not. It would be a huge step back for their product if 2FA becomes mandatory.

View on HN

That actually happened to me a couple years ago. I was in a foreign country, and lost my phone. All I had to do was buy a new cheap phone and login to Bitwarden again. If I had 2FA enabled, I'd be completely screwed.

I have hidden recovery information in a few places on the internet - someone stumbling across it would not know what they are looking at, or what it's for. For example, you can hide the TOTP secret for an authenticator app, but it's useless unless you know what account and service it's for, and the associated master password.

So to mitigate lockout risk, you keep multiple Yubikeys, store recovery codes in multiple physical locations including presumably a fire-proof safe bolted into your home (at your expense), and use obscurity to store the TOTP secret on random places in the internet, presumably relying to external services or a self-hosted solution, which are themselves dependent on regular credit card payments going through.

Okay, I grant that you've reasonably mitigated the lockout risk. But I don't want to do any of this, and is it really reasonable to expect the everyday person to understand or implement all this? What happens in practice is that many users will not realize anything is wrong until they get locked out with no recourse.

This makes it hard for me to recommend Bitwarden to my friends who use typical insecure practices like password reuse or post-it notes.

> But I don't want to do any of this

Security has either been easy and weak, or difficult and strong. It will never change and so you will always have the option of weak security if you dont want to jump through the hoops for the peace of mind.

> my friends who use typical insecure practices like password reuse or post-it notes

IMO people who do those things will never change. Its like the environment, everybody knows what they should be doing but no-one cares enough to do it.

So Bitwarden should offer 2FA for users who want the additional security – they should never force users to enable it. It would be like refusing to save "password" as a password, because it is insecure.

A better way to mitigate lockout risk is to use a 2FA mule:

https://kozubik.com/items/2famule/

Since Bitwarden can directly email 2FA codes, this arguably would be needlessly complicated in this context.

If someone is locked out of their password vault, they are likely also locked out of their email...

If you have literally no other option than SMS 2FA because of bad support from websites, maybe. Otherwise it's probably one of the worst options (though I suppose unlike using your main number at least it's harder to discover the number for the 2FA phone to attack it with social engineering).

sure, but we shouldn't have to do that if we don't want to. it shouldn't be "mandatory"

Same here, mine got pickpocketed. My mates laughed at me because they thought I was an idiot not be able to login to my accounts.

Was easily solved though, got a new SIM card from my network from the local store when I got back and recovered my Authy account via SMS which I can then generate 2FAs for my password app through. Was always a backup method I had up my sleeve. My browser keeps logged in as well so was able to get into most stuff through my PC once I got back.

> Bitwarden itself recommends printing out a recovery code and storing it in a safe, but what happens if you lose access to that safe?

I feel like your own creativity is limiting you here. There are lots of options to store those backup codes. Including giving them to multiple relatives to keep in a safe place so you can call and ask for it, creating a dedicated email account with no 2fa and email the code there, leave yourself a saved answerphone message with it on so you can dial in and listen, write it in the important info section of your passport so you always have it abroad etc etc...

> creating a dedicated email account with no 2fa and email the code there

Of course, that account could also decide to implement mandatory 2FA. Could even be unannounced, just "This login is suspicious, we sent a message to your recovery email to confirm this login"

It's great that recovery codes exist, but the security model can't rely on them. Unused email accounts get deleted, yubikeys get lost or reset, relatives lose documents, passports get renewed, house fires and car accidents happen, time passes, etc.

Any critical procedure needs to be exercised regularly to ensure it's still working. Normal people don't do that with recovery codes.

All of these things can be mitigated by a little care and attention by yourself.

What you are really saying is you want a way to be able to recover your account thats easy, quick, and you dont need to think about it. Unfortunately strong security will never be any of those things.

It doesn't matter how you want to describe it, keeping recovery keys available is an ongoing maintenance burden that most people aren't going to do perfectly. It's not appropriate to blame users for reasonably foreseeable problems with a fragile system and lock them out of their bank passwords.

Any concept of "strong security" that doesn't consider losing access to be a security issue is, at best, amateur.

If a state actor can't access your email, but you also can't access your email (and receive notices of login attempts, password reset attempts, server intrusions, etc.), then you absolutely do not have a good security posture.

Reply on news.ycombinator.com