You Should Know

On the other hand, NOT using MFA on an online password manager is just poor opsec.

This is a good thing. Any account you care about and don’t want to be accessed by anyone without your consent should have multifactor authentication enabled. Use an app like Google Authenticator or a hardware token like a Yubikey. 2FA through text or email is insecure and easily bypassed.

Friends don’t let friends raw dog the internet. Don’t be dumb and get your shit stolen. Use MFA everywhere.

The amount of people not already using MFA in this thread is too damn high!

I hate this so much. My Bitwarden password is the one thing I know. I'm not confident I could ever learn another password, especially one I barely ever need.

And 2FA? What if my phone breaks? My 2FA recovery codes are in Bitwarden.

Ugh. I have no idea what I'm going to do.

My email is one of the few passwords I still know without my password manager.

It probably is time for me to rethink that 🤔

To be fair your post title does not match their own text

To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login.

So it's not all accounts, just the ones that don't already have 2FA. Personally I wouldn't have noticed any changes since I already use 2FA enabled with an authenticator app. But I can see how this might bite you in the ass if you weren't already using 2FA.

Interestingly I used to run into a similar issue when using Lastpass. When logging in from other IP addresses they would often do mandatory email 2FA, and of course I couldn't get into the email account without Lastpass. But it sort of resolved itself since I also have email on my phone so I just had to make sure those Lastpass emails didn't end up in spam or wherever.

This is likely timed to meet the new PCI requirements, since they are designed to store your credit card info if you want to, and MFA will be a requirement as of April 1st this year. Everyone should be using MFA for this kind of information anyway, I know people hate inconvenience in the name of security, but if safety wasn't forced on people we wouldn't have things like seat belts, hand rails, and factory safety lockouts.

This is not the end of the world, some mighty overreaction on the comments. This is why diversity is the answer to security. Multi factor, multi mode, multi device. Something you know, something you have, something you are, etc.

If you have more than one device, like PCs, laptop, phone, in any combination, and you have your access config on all. Then there's an infinitesimally small chance you'd lose access to your vault.

PSA: Vaultwarden is easy to self host.

This introduces so many failure modes. What if my email provider goes bankrupt, or fucks up their servers, or bans me? Access to my Bitwarden Vault is now dependent on some company's whims

@OP There will be an option to turn it off, maybe add that to the post

An option to turn off new device login protection will be available in the web vault account settings

Anyways thank you so much OP for notifying me, their fuckup would've impacted me as well

"who do not use two-step login"

I'm getting sick of all this two step verification and code confirmation bullshit. I don't need my Instagram password stored in a bank vault with 24 hour security. Let me opt out of all this extra security and if it gets breached then blame me for opting out.

I don't even have two step verification turned on for something and I still needed to check my email for a code and then when logging into the email I needed to check my phone for a second code just so I could access the first code for some bullshit account I hardly ever use. It's incredibly frustrating.

If I want to go through all that shit for security purposes then I will ask you to go through all those steps. Don't force me to. Fuck.

I don't use bit warden but, that sounds like a flaw that can very easily fuck your system up.

I find it stupid as a mandatory requirement, if you don't want to use 2fa then you should be allowed not to, it's still a multitude better than just using the same password for everything of having it on a text document on your computer.

Thanks for the heads up, though this would be less of an issue if you have the email app on your phone or the tab pinned in Firefox.

The real issue is i gotta use another authentication app for my email now, have been using Bitwarden itself for 2fa codes for proton. Definitely can’t use proton pass to 2fa for my proton account.

I don’t even know. Gonna have to find another reputable authenticator app.

Guess I should also check if Bitwarden or proton support physical security keys. Would be pretty bomb proof since my keys are always in my pocket anyway.

something done by many services, sites, and games.

but yea, i get it. the problem of asking someone to login to a service that they (bw) are holding your key for, in order for you to get into where that key is held.

This is stupid.. Now where would i save my mail password

What if you host via Vaultwarden? Do you have control over it?

Why would they ever force this?

The purpose of MFA is to:

Mitigate using the same password on multiple sites and one of them has a data breach.

Mitigate the impact of keyloggers/other kinds of malware.

Mitigate the bad security of bad passwords.

Mitigate the password manager's own data breach.

If you have at least two braincells, you will chose a unique and secure password for your password manager. That's the point of password managers, that you only have to remember 1 password so it can be unique and strong. Also, a password manager (specially open source) should have almost perfect security, so them being hacked should not be a concern.

The only thing MFA is doing on password managers is to mitigate malware. Which I don't think is a good justification to force everyone the hassle of MFA.

Fine if the wanna give the option of MFA, but don't force it on everyone.

Guess its time to set up a hardware key

For what it's worth, as of a minute ago the form that's for sending the email code asks if you have reliable access to the email before sending the code.

But otherwise seems to be a non-issue with any of the software/hardware mfa options it supports. Good to let others know about this though!