Hacker News Reader

Comment by TheFreim | Hacker News Reader

I can understand adding some friction to discourage using Bitwarden without 2FA, but requiring it seems very wrongheaded to make it mandatory. I've been using 2FA on Bitwarden for a while and it adds a lot of friction and made me very nervous that if I lost my phone that I'd be locked out of literally every account I have. I mentioned elsewhere (link below) that I have solved this issue for myself, but people shouldn't be required to jump through these hoops and introduce a greater opportunity to lose access to their accounts if they should lose their phone.

https://news.ycombinator.com/item?id=42853696

View on HN

And even if F2A wouldn't have ANY downsides, it's still not their fucking business if users want to use it or not. There is a million ways to leak your credentials to a service anyway, and I don't know anything more annoying than when a service tries to protect you from yourself (sometime locking you out of your account while doing so). If a user wants to have no F2A, no backup email, to use qwerty as a password and to write it on a sticky-note attached to a display, it's their right to do so. It's not Bitwarden's (or anyone else's) responsibility.

I agree, and when I first read the headline, my reaction was "Well, I guess it's time to start researching different password managers, because I obviously can't use Bitwarden anymore."

However, despite what the headline says, this 2FA does not appear to be mandatory.

Under the heading: "Who is excluded from this account email-based new device verification?"

> Users who opt-out from their account settings, to which an option will be added, are excluded.

To clarify, this was new information added to the release within the past hour or so, which seems like the company responding to criticism. The original article gave no indication 2FA was anything but mandatory.

Thank you. The title should be changed, really. Following an ancient HN custom I've chosen to get annoyed before reading the article, and the title simply isn't true. In fact, it's exactly what GP suggested, which is a perfectly nice way to implement that. (Unless, of course, one day they get rid of that option as well...)

The title was changed, but it's worth pointing out that they updated the article AFTER criticisms in this thread were already made (the original policy did not say you could opt-out):

https://news.ycombinator.com/item?id=42859698

It seems like the alternative is to allow anyone with just the master password to get access to your vault. That doesn't seem so great.

I'm on 1Password and it's basically a 2FA setup there too: to register a device, you need to have the master password (what you know) and the secret key (what you have, randomly generated at vault creation). Losing my phone isn't a big deal because I have 1Password on multiple devices, each with a copy of the secret key, so there's pretty good hedging there.

I also carry a physical Yubikey, which grants me passwordless access to my email account (assuming I know the PIN to unlock the hardware, which I do). That's probably overkill for most people, but that's another layer of hedging too.

> It seems like the alternative is to allow anyone with just the master password to get access to your vault. That doesn't seem so great.

Given that only I have my master password I don't see what's wrong with it.

What if, for example, a piece of software is logging your key presses without your knowledge? You could have the best, most secure password but you're typing it into a complex machine which could be doing any number of things. Don't forget that you're human and make mistakes too so it doesn't necessarily have to be malicious; a bad copy paste into a public forum post could hose you.

A second factor makes it extremely unlikely that one slip up results in a complete compromise of your vault.

> What if, for example, a piece of software is logging your key presses...

Even easier: What if someone beats you with a stick until you unlock your password manager?

Security is always a compromise around a lot of assumptions about threat model, usability, etc.

Nudges are a great way to increase overall user security with almost no drawbacks, but ofc ultimately things like this always have to be user choice.

I think what you're forgetting is that Bitwarden only has access to my passwords, not any account (that does any important work) itself.

All my high security accounts themselves are protected by 2FA and in some cases 2+ factors (such as my bank).

2FA on a password manager is useless. I'm going to end up entering phone codes multiple times for a single login and that will drive me away from using the password manager.

If there is software that is logging my keys it can also likely steal my cookies, in which case they don't even need any of my passwords or 2FA codes.

You don't even need a keylogger for password leakage. You could accidentally type in your password into a logged field because you forgot to press tab or alt-tab to move cursor focus.

2FA for setup doesn't strike me as too onerous. It only happens once per device, after which you're free to rely on just your master password or even biometrics.

It's, possibly, not good enough. In case of a fire, if you left all your phones at home, you are screwed.

Exactly because of the fire risk, I set a policy for myself that all passwords should be somehow recoverable only from something that I know. However, I don't meet this policy at the moment.

> very nervous that if I lost my phone that I'd be locked out of literally every account I have

I use Bitwarden 2FA with my phone, but I have backup codes stored in a fireproof safe with my other important documents.

Aren't you screwed if you can't get access to your home for whatever reason ?

That hopefully would only happen in extremely rare conditions, but that's not a risk everyone would take. Especially in area where losing your home is a very real risk, and you'd be hanging to your data by a string while facing an otherwise already challenging situation.

You certainly shouldn't rely on just your phone. If you store your 2FA token in Bitwarden, you can use any of your other devices that you have used Bitwarden with recently.

The 2nd factor is only needed when it's new or occasionally in other cases. I don't know why you say it adds lots of friction, unless you are frequently signing into new devices.

And as a failsafe a printed backup code is pretty important.

I understand that in theory storing the 2FA for Bitwarden in Bitwarden itself can work, but I don't know if I can ever bring myself to store the key to the car in the car, even if I pinky promise myself that I'll never lock all the car doors at once.

This is doubly true because Bitwarden has not been consistent at only asking for 2FA on brand new devices, so it's not even just me that I have to worry about locking the car doors.

Friction is bad security. Simple as that.

Removing the friction of many passwords is the whole reason a password manager is good in the first place!

It seems like every IT person needs this lesson reiterated to them, at least once a year...

I am not suggesting friction as security, I am suggesting it so that the average user is funneled towards the most secure option, i.e. using 2FA, while allowing experienced users to put in a small amount of effort to disable it.

That's not a meaningfully different context, unfortunately.

You don't need your phone. You need access to your email account. This is described in the article.

Like numerous others, my email account password and 2FA codes are in Bitwarden.

I dont understand why people do this - those “bedrock” accounts like bank accounts shouldnt be in your password manager in my opinion.

At the very least split your providers - no one manager has all my passwords and 2FA codes.

Because for security (!), I use a very strong and difficult to memorize password, with no backstop if I forget it. I only want to memorize one of those.

why is this safer than requiring 2 master passwords. at the end an email account is accessible via a password.

Hopefully your email also requires 2FA :)

Even without, accidentally getting one password leaked is a lot more likely than two. For whatever reason, shoulder peeking, keylogger, wrong input field, brute forced, and so on.

yeah so 2 passwords would do the same trick then?

In my mind the email is the second worst 2FA since it's used for registering everywhere on the web and more prone to be compromised. Phone number is the worst.

I'm so fucking sick of places enforcing that shit. Not all of us have shit passwords.

There is still a ceiling to how secure a password can be which 2FA solutions will generally beat (mainly by the secret not being spread as far when used, such as keyloggers, window focus mishaps, or simply being sent to the server verifying it).

At least they are not 100% head-in-ass sesoority yet and still allow to at least self-host to disable that crap.

Reply on news.ycombinator.com