12 ms·
Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password
- teruakohatu 4y agoIs 2FA still hidden behind the paywall? While bitwarden does this they are doing a major disservice to the averge (unpaid) user. Edit: thanks, sounds like 2fa is now free.
- castrodd 4y agoIsn’t it like $10 per year for a premium account?
- Alupis 4y agoYes, and worth every penny in my experience. It's really a great app, and a great service. Happily paid my $10 after using it around the office for a few months (paid Teams account). We came from KeePass, so the whole cloud thing was new. But it's "just worked" remarkably well. The multiple-profiles feature was a game changer, allowing me to access both my work credentials and personal credentials from the same app, while keeping them entirely separate is really nice.
- y0ssr3n 4y agoThe free plan supports the following types of 2FA: "Email, Authentication App" Upgrading to the Premium Account ($10/yr) gets you additional options: "YubiKey, FIDO2, Duo, Email, Authentication app" Source: https://bitwarden.com/pricing/ https://bitwarden.com/pricing/
- llampx 4y agoI use 2FA with a free account.
- sschueller 4y agoI just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/
- Someone1234 4y agoBecause it uses Docker and that is what Docker requires.
- x3n0ph3n3 4y agoNo, it's because it uses _several_ docker containers and runs mssql.
- Someone1234 4y ago"No" then go on to reinforce my explanation. Those minimums are taken from Docker. The person above asked why they were what they were, I answered. You're just further reinforcing what I explained.
- cweagans 4y agoRunning something in a Docker container adds very very little overhead - to the point that it's almost immeasurable. The resource utilization is specifically because of the services that have been packaged in the containers. If you were running the Bitwarden server on bare metal (which you can definitely do), the requirements would still be the same.
- x3n0ph3n3 4y agoVaultwarden also uses docker and is a single container with minimal resources.
- turmeric_root 4y agoVaultwarden's Docker images are much smaller: https://hub.docker.com/r/vaultwarden/server https://hub.docker.com/r/vaultwarden/server
- Someone1234 4y agoThey're literally taken from Docker's website: - https://docs.docker.com/desktop/install/linux-install/ https://docs.docker.com/desktop/install/linux-install/ HN has reached the point, that it will heavily downvote an objective fact because it goes against the pointed narrative. They took a dependency, copied its system requirements, and someone asks "why?" and that is the actual answer. A lot of the other answers (multiple Dockers, slimmer image) really address how Docker themselves have these exact system requirements listed, but why do they need to when the point isn't to answer the actual request asked by get lost into a predisposed critique.
- yasp 4y agoHow does Bitwarden protect against a malicious mobile app update?
- palata 4y agoHow do you mean that?
- sneak 4y agoA compromised Apple developer account login pushing out a compromised Bitwarden mobile app to the Apple App Store that steals everyone's master passphrases.
- freeplay 4y agoValid question. Although how could any product protect against that kind of attack? If the supply chain is compromised, it's pretty much a wrap.
- palata 4y agoIf the Bitwarden developer account is compromised, one can indeed send an app that steals the passwords. But the devs would (most likely) see that someone else is pushing updates, and that would be the end of Bitwarden, so you can consider it is their job to not let that happen :-). This is not specific to Bitwarden though, it's the same for all apps. Now because Bitwarden is open source, you can actually compile and install it yourself (if you're confident that the sources you are compiling are the legitimate ones, and not a fork that will steal your passwords ;-)). Same applies for e.g. Signal Messenger: since it's difficult to check what version of the code is coming from your store, you can always compile it from source and install it yourself.
- OJFord 4y agoUnfortunately no plans to offer it for third-party stored credentials though - this is just for 'unlocking' Bitwarden itself. 'Passwordless' badly needs 'password manager' support, or other cross-platform implementation, IMO.
- cmdli 4y agoIf you are looking for something like a password manager but for passkeys, I would like to plug my own product Bulwark Passkey (https://bulwark.id https://bulwark.id). It allows you to sync accounts across devices and is entirely open source. Overall, I think what passkeys need right now is more flexibility. Nobody is going to switch to passkeys if they are locked to their Apple account, for example.
- sebk 4y agoThank you for having an honest FAQ, especially about keys not being backed by hardware and its implications. Some competitors implementing a comparable mechanism have been very quiet about it and have severely undermined my trust in them. Hopefully we'll see OS and hardware vendors provide APIs so that third party passkey managers can leverage secure hardware in the future.
- cmdli 4y agoYeah, trust is a big thing for me when it comes to security software, so I wanted to be upfront about what the software is good/bad against. I personally think that moving away from passwords is worth it, even if the credentials aren't stored in silicon, but I can appreciate those people who want their keys stored as securely as possible.
- rrgok 4y agoAdmittedly I've done a little research, but every time I read about I don't understand how passkeys/fido/yubikey works. Is it guaranteed that all the services I use support passkey/yubikey/fido? If not, what should I do? Have some of services in a passkey/fido/yubikey (like yours) and the remaining in Bitwarden or other password manager? Can someone ELI5 how this works? I went to fidoalliance.org and honestly, I didn't understand a thing. I still don't understand Yubikey and its MFA, it feels so cumbersome and huge PITA to do it every-time. Am I missing something? My workflow now is: CMD+SHIFT+L, enter master-password once and that's it for the current OSX login session. Will Passkey or FIDO or Yubikey improve this speed of interaction?
- oddeyed 4y agoI had no idea this was a new feature but used this today. It was extremely convenient!
- sakisv 4y agoThat's very nice, well done! For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so mechanically when I'm on my laptop, that I really struggle to remember it when I have to type it on a screen - to the point that I must go sit at a computer open a notepad, let muscle memory take over and then look at the screen to see what I typed /facepalm Anyway, in all seriousness, while this is a scenario that happens very rarely, it still makes me wonder if it would be possible to do the pasdwordless login the other way, i.e. authenticate the phone using a trusted laptop (maybe a fingerprint enabled one)?
- zem 4y agoi use a regular english sentence as my master password; seems to strike the right balance between not brute-forceable and easy to remember. am i missing some potential drawback to doing that?
- ReaLNero 4y agoOne thing to consider is that you can infer your password structure by ear (e.g. how many times the space bar was used, any modifier keys), making dictionary attacks much scarier, especially if your threat model includes people in close proximity/public areas.
- sandworm101 4y ago>> am i missing some potential drawback to doing that? My work machines (government) check for "commonly used words" and will generally reject natural language even if squashed between punctuation marks. "P@ssword" would probably slip through, but "GodIHateRememberingAllTheseStupidPasswords!@#!@" doesn't.
- Fervicus 4y agoHa! I can definitely relate. Takes me 3-4 tries to get the password correct on mobile, and not so rarely I have to type it on the computer first.
- 4y ago
- ghostly_s 4y agoWaaay at the bottom: Note: Logging in with a device is currently only available on the Bitwarden cloud server (https://vault.bitwarden.com). And even there, I followed all the directions and don't have the 'Log in with device' button. Waste of time.
- paulryanrogers 4y agoMaybe a progressive rollout. Perhaps the announcement is premature or lack that detail, if accurate.
- ianmcgowan 4y agoI had this same experience. The fine print says you have to log in without passwordless at least once, and after that it starts working. It's a low-risk pilot of the feature I think, but will be more useful to me when it comes to the extension. It's strange that you have to sign in to the app at least once, seems to negate one of the common use cases. The only hesitation for me is as other folks mentioned - never typing the master password again might make remembering the pass phrase challenging..
- imwillofficial 4y agoBitwarden is such an amazing value. $10 a year, constant progress, secure, quality product
- deadbunny 4y agoWhen my subscription renewed last month I did a double take when I saw it was only $10. Had completely forgotten how cheap it was. Hopefully the recently VC cash injection doesn't massively inflate that.
- syncerr 4y agoPasswordless is going to be great. Though, this is just for unlocking your bitwarden account. Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If you haven't seen it, Auth0's demo is helpful[2]. [1] https://www.w3.org/TR/webauthn-3/#sctn-api https://www.w3.org/TR/webauthn-3/#sctn-api [2] https://webauthn.me/ https://webauthn.me/
- cmdli 4y agoPasskeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device, I would like to plug my solution, Bulwark Passkey (https://bulwark.id https://bulwark.id). It's open source, allows you to export your credentials if you want, and supports all browsers since it emulates a virtual USB device.
- postalrat 4y agoIMO having devices that can be cloned will always be a weakness. Backup devices work fine.
- judge2020 4y agoThe threat vector for your passkeys being stolen is the same as current passwords, that's true (because they're just in some syncing database), but it solves many issues that are the leading cause of account compromise these days, mainly phishing and reused passwords.
- hedora 4y agoSo, for me, there is no real upside, other than not needing to click "generate password" in my password manager. What downsides are there? E.g, will it work on rooted phones? Will apps start adding mandatory pin numbers on top (like they do for biometrics), or will Google/Apple's app stores disallow it? How do I "log out" to avoid tracking without being implicitly logged back in? What happens if I routinely wipe my browser settings? Can I use some other person's computer to login in a pinch? (Such as when my phone is off network?) In principle, browser and os vendors could work through all these "niche" use cases, but I'll be pleasantly surprised if they actually did.
- SuperSandro2000 4y agoBut to secure my hardware security key I need a PIN, too otherwise anyone can just borrow it. Also I still need a backup in case I actually lose it somewhere. And when I get recommended to reinstall my browser to fix a problem and I accidentally deleted my profile I might lose access to accounts.
- longcat 4y agoPassKey is great but also may cause vendor lock-in looking at Google and Apple in particular. Does anyone have any insights to how enterprises will be managing passkeys for corporate accounts with the potential of creds being leaked to potential compromised devices.
- stavros 4y agoHopefully, $20 USB keys.
- aborsy 4y agoHardware keys are better. Phone’s operating system is a huge code base. Also, iPhone’s operating system is a closed source proprietary black box.
- piskerpan 4y agoHow do you link your hardware key to the website? You still have to plug it into a proprietary black box. If you think your computer security is weak, it will continue to be the weak link even with with a hardware key.
- aborsy 4y agoIf the computer is compromised or backdoored, it will have access to private keys for websites that I access on that computer, one per each touch, not the database of all private keys. For example, I may not connect my Yubikey to some computers at all. Hardware keys are made not to give out secret keys without physical touch. Firmware in Yubikey is not updated, unlike over the air phone update.
- presto8 4y agoThis is a really great user experience. One thing I wonder about is if people start logging in without their password all the time, will they slowly forget what their password is over time? Partly to force memory reinforcement, I set the password cache time of gpg-agent on my machine to 24 hours maximum. Thus I have to enter my password once a day, which helps me to remember it; but it isn't overly burdensome. Although maybe if one always has
- joombaga 4y agoThat's is exactly what happened when I configured the LastPass browser extension to remember my password. I needed it to switch USB security keys and had no idea what it was. The saved password in my other browser's extension saved me.
- haspok 4y agoMy master password is "public" (I put it in a mail draft, also a note on my phone and printed it out on a piece of paper, just to be sure), and I have 2FA enabled via Yubikey. I never really understood why I had to always provide my master password anyway when logging in even on a trusted device, as the whole point of a password vault is to no longer have to remember any passwords... but we are getting there, eventually.
- sebk 4y agoI'm not sure what service you're using, so this might or might not apply to you: Consider that some password managers use MFA to allow you to connect to their online service that will download a synced, encrypted copy of your password vault, but the vault itself is only wrapped with a key derived from your master password. If someone was to obtain a copy of your vault, decrypting it would be trivial with a weak or compromised master password in that case. CTAP supports an extension called hmac-secret that would allow you encrypt your vault, which would mitigate this issue (While introducing others potentially -- for instance, hmac-secret does not require user verification so anyone with your yubikey could decrypt it). Of course there are other mechanisms to encrypt a vault other than a key derived from a password that you can use with a Yubikey, like PGP, but I don't know of any commercial password manager that does it that way.
- dengolius 4y agoBitwarden can't import my ssh keys from lastpass export <facepalm> it say: [1198] [SecureNote] "username id rsa ssh": The field Notes exceeds the maximum encrypted value length of 10000 characters. But this id_rsa has only 1415 symbols 1password has imported csv as well without any issue or alert. So login from device is not a big deal.
- Always42 4y agoyes, then I can help my family reset 1 less password...
- denhaus 4y agoAm I the only one who just cannot STAND MFA? Having to get a notification text etc. Like what if I don’t want to give an app capability to notify my phone? What if I want something totally NOT connected to my phone? I just envision a future where there is some near-circular dependency of passwords/phrases/notifications/authenticators/keys/email verifications etc across different devices and services - the end result is that it is absolute PiTA to log into anything or recover any account if anything is ever lost. Sort of an endless personal bureaucracy for authentication. It’s a future I am personally trying to avoid at all costs Yubikeys etc seem like something I could potentially get behind, but it still doesn’t seem perfect persay… anyway, maybe I am just a geezer
- deleted 4y ago[deleted]
- _8j50 4y agoThat's why I like TOTP, you can use a phone (i have a dedicated disconnected phone for it) or an rpi, hardware dongle,etc.. but it is phishable
- Tidal5474 4y agoMFA is not going away, but neither is it going to become what you are describing. MFA using an SMS is not secure. If people reliably made good passwords and never reused them, we probably wouldn't need MFA as much. Unfortunately, we live in a society. Bitwarden will remember your TOTP codes for you across any device you login from. It will even copy the code to you paste buffer during a login. I enable MFA everywhere i can, even for stupid stuff. Its just not an inconvenience using bitwarden.
- martin_a 4y ago> MFA using an SMS is not secure. Why not? Is it that easy to intercept a SMS or is that just due to poor handling with some providers?
- phantomathkg 4y ago
- account-5 4y agoHow long before you need 3 devices to log into something? Like the other commenter I don't want or need MFA. It's more complicated and a pain to use. Just seems like a convenient opportunity for online companies to gather more data points about you. Keepassxc with a key file is still going strong for me. You've no need for my phone number! And I don't want my device linked to any account.
- blitzar 4y agoIt is off by default.
- rwky 4y agoHopefully you can turn this off. I've seen cases where attackers enter an email address and just keep spamming the login form until the owner accepts the notification. Obviously 2fa would help here but not everyone uses that.
- haspok 4y agoDoes this also work with the Firefox plugin? Can't wait to get home and find out...