Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

https://bitwarden.com/blog/passwordless-authentication-access-your-bitwarden-web-vault-without-a-password/

by jacooper • 4 years ago

240 136 4 years ago

Is 2FA still hidden behind the paywall? While bitwarden does this they are doing a major disservice to the averge (unpaid) user.

Edit: thanks, sounds like 2fa is now free.

castrodd• 4 years ago

Isn’t it like $10 per year for a premium account?

Alupis• 4 years ago

Yes, and worth every penny in my experience. It's really a great app, and a great service.

Happily paid my $10 after using it around the office for a few months (paid Teams account).

We came from KeePass, so the whole cloud thing was new. But it's "just worked" remarkably well.

The multiple-profiles feature was a game changer, allowing me to access both my work credentials and personal credentials from the same app, while keeping them entirely separate is really nice.

y0ssr3n• 4 years ago

The free plan supports the following types of 2FA: "Email, Authentication App"

Upgrading to the Premium Account ($10/yr) gets you additional options: "YubiKey, FIDO2, Duo, Email, Authentication app"

Source: https://bitwarden.com/pricing/

llampx• 4 years ago

I use 2FA with a free account.

sschueller• 4 years ago

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members?

[1] https://bitwarden.com/help/install-on-premise-linux/

Someone12343• 4 years ago

Because it uses Docker and that is what Docker requires.

x3n0ph3n32• 4 years ago

No, it's because it uses _several_ docker containers and runs mssql.

turmeric_root• 4 years ago

Vaultwarden's Docker images are much smaller: https://hub.docker.com/r/vaultwarden/server

Someone12343• 4 years ago

They're literally taken from Docker's website:

- https://docs.docker.com/desktop/install/linux-install/

HN has reached the point, that it will heavily downvote an objective fact because it goes against the pointed narrative. They took a dependency, copied its system requirements, and someone asks "why?" and that is the actual answer.

A lot of the other answers (multiple Dockers, slimmer image) really address how Docker themselves have these exact system requirements listed, but why do they need to when the point isn't to answer the actual request asked by get lost into a predisposed critique.

alyandon• 4 years ago

Check out Vaultwarden instead - https://github.com/dani-garcia/vaultwarden.

It is written in Rust and is much lighter on resource requirements.

  CONTAINER ID   NAME        CPU %     MEM USAGE / LIMIT     MEM %     NET I/O           BLOCK I/O         PIDS
  ecce485b8b3a   bitwarden   0.06%     46.58MiB / 1.937GiB   2.35%     1.63MB / 28.1MB   17.5MB / 81.9kB   11

thewataccount3• 4 years ago

I've been considering vaultwarden, question though.

I assume bitwarden's implementation has been more thoroughly reviewed.

Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?

suumcuique• 4 years ago

It includes a MS SQL server among other things, so for serving single digit users its gonna be heavy. Check out Vaultwarden as an alternative for small scale self-hosting.

heresjohnny• 4 years ago

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

zikduruqe• 4 years ago

Just use passwordstore.org and stand up a bare git repo. It really doesn't need to be terribly complicated.

sam_goody• 4 years ago

Sure.

Hosting your own is a twenty minute setup, more or less, and $5/mo on Hetzner. Uptime, in my experience, is 5 nines.

With SaaS, I am losing the main reason that I am using Bitwarden - that I don't want the X agency to force Bitwarden to give them my passwords.

And I know that if said agency (it varies by country and target) could definitely hack the VPS if I was important enough, that is not part of my threat profile. Self hosted is far less likely to get auto vacuumed than SaaS data.

iso1631• 4 years ago

Yup, it's not rocket science if you already run your own services. An entire generation of techies seem to be completely scared of running their own machine and think it's some kind of massively difficult task.

koevet• 4 years ago

I have been running Vaultwarden (formerly known as bitwarden_rs) for years in a docker container and I don't remember a single time that it went down.

Yujf• 4 years ago

Better security for sure. Bitwarden is a massive target while I am not. The chance that bitwarden has a databreach is way bigger than the chance that my server gets hacked. No one cares about my server, I am nobody not worth attacking. As long as I don't leave any big holes that can be found by an untargeted attack (which I won't, I run everything behind a personal VPN) it is safer.

slock83• 4 years ago

Same or better uptime might not be granted, but I've been hosting my instance for quite a bit of time now, and the only downtime I've had were due to my ISP. I'm using vaultwarden too (bitwarden_rs when I first deployed it), and have absolutely no complains whatsoever.

Also, after your device synced with the server at least once, you can still access and export all your passwords, even if the server is down. This is the main selling point for me : even in a disaster scenario, your passwords are "naturally" replicated.

Mine is exposed behind a reverse proxy, with a subdomain != Bitwarden, and a wildcard certificate. Never seen anything weird in the logs since (before, I had a named certificate including subdomain, and I was seeing regular pokes from unknown IPs, so better be on the safe side)

Again, the main bitwarden instance is a huge target. Mine is just a small instance with less than 10 users, which will probably never encounter a targeted attack.

michelllle• 4 years ago

"Bitwarden has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately. Bitwarden reserves the right to refuse service to anyone for any reason at any time."

Who would trust their passwords to a service with such a clause?

jve• 4 years ago

I'm hosting Bitwarden on RPI4B, but using bitwarden-rs lightweight server. Along with nextcloud, home assistant and photo gallery.

Well, yes, after adding photo gallery, I now want a faster device.

yasp• 4 years ago

How does Bitwarden protect against a malicious mobile app update?

palata2• 4 years ago

How do you mean that?

sneak2• 4 years ago

A compromised Apple developer account login pushing out a compromised Bitwarden mobile app to the Apple App Store that steals everyone's master passphrases.

OJFord2• 4 years ago

Unfortunately no plans to offer it for third-party stored credentials though - this is just for 'unlocking' Bitwarden itself.

'Passwordless' badly needs 'password manager' support, or other cross-platform implementation, IMO.

cmdli7• 4 years ago

If you are looking for something like a password manager but for passkeys, I would like to plug my own product Bulwark Passkey (https://bulwark.id). It allows you to sync accounts across devices and is entirely open source.

Overall, I think what passkeys need right now is more flexibility. Nobody is going to switch to passkeys if they are locked to their Apple account, for example.

sebk2• 4 years ago

Thank you for having an honest FAQ, especially about keys not being backed by hardware and its implications. Some competitors implementing a comparable mechanism have been very quiet about it and have severely undermined my trust in them. Hopefully we'll see OS and hardware vendors provide APIs so that third party passkey managers can leverage secure hardware in the future.

oddeyed• 4 years ago

I had no idea this was a new feature but used this today. It was extremely convenient!

sakisv• 4 years ago

That's very nice, well done!

For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so mechanically when I'm on my laptop, that I really struggle to remember it when I have to type it on a screen - to the point that I must go sit at a computer open a notepad, let muscle memory take over and then look at the screen to see what I typed /facepalm

Anyway, in all seriousness, while this is a scenario that happens very rarely, it still makes me wonder if it would be possible to do the pasdwordless login the other way, i.e. authenticate the phone using a trusted laptop (maybe a fingerprint enabled one)?

Fervicus• 4 years ago

Ha! I can definitely relate. Takes me 3-4 tries to get the password correct on mobile, and not so rarely I have to type it on the computer first.

Rodeoclash• 4 years ago

I'm in exactly the same boat. Incapable of typing my master password on a mobile screen because it's just muscle memory.

I've had times where I've needed to get into my account in a hurry and had to find a POS terminal with a keyboard so I could activate the muscle memory.

zem• 4 years ago

i use a regular english sentence as my master password; seems to strike the right balance between not brute-forceable and easy to remember. am i missing some potential drawback to doing that?

ReaLNero• 4 years ago

One thing to consider is that you can infer your password structure by ear (e.g. how many times the space bar was used, any modifier keys), making dictionary attacks much scarier, especially if your threat model includes people in close proximity/public areas.

sandworm101• 4 years ago

> am i missing some potential drawback to doing that?

My work machines (government) check for "commonly used words" and will generally reject natural language even if squashed between punctuation marks. "P@ssword" would probably slip through, but "GodIHateRememberingAllTheseStupidPasswords!@#!@" doesn't.

trog• 4 years ago

I just have the master password saved in my browser. I realise this is probably sub-optimal for a lot of people but for my workflow (i.e. the kinds of passwords I put in BitWarden) it works out OK.

ghostly_s• 4 years ago

Waaay at the bottom:

    Note: Logging in with a device is currently only available on the Bitwarden cloud server (https://vault.bitwarden.com).

And even there, I followed all the directions and don't have the 'Log in with device' button. Waste of time.

paulryanrogers• 4 years ago

Maybe a progressive rollout. Perhaps the announcement is premature or lack that detail, if accurate.

ianmcgowan• 4 years ago

I had this same experience. The fine print says you have to log in without passwordless at least once, and after that it starts working. It's a low-risk pilot of the feature I think, but will be more useful to me when it comes to the extension. It's strange that you have to sign in to the app at least once, seems to negate one of the common use cases.

The only hesitation for me is as other folks mentioned - never typing the master password again might make remembering the pass phrase challenging..

imwillofficial• 4 years ago

Bitwarden is such an amazing value. $10 a year, constant progress, secure, quality product

deadbunny2• 4 years ago

When my subscription renewed last month I did a double take when I saw it was only $10. Had completely forgotten how cheap it was. Hopefully the recently VC cash injection doesn't massively inflate that.

syncerr• 4 years ago

Passwordless is going to be great. Though, this is just for unlocking your bitwarden account.

Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If you haven't seen it, Auth0's demo is helpful[2].

[1] https://www.w3.org/TR/webauthn-3/#sctn-api

[2] https://webauthn.me/

cmdli7• 4 years ago

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything.

As a side note, if you want to try out passkeys now and don't want to tie it to your device, I would like to plug my solution, Bulwark Passkey (https://bulwark.id). It's open source, allows you to export your credentials if you want, and supports all browsers since it emulates a virtual USB device.

postalrat• 4 years ago

IMO having devices that can be cloned will always be a weakness. Backup devices work fine.

notlukesky• 4 years ago

When did you release it and how is it coming along? Is there any resistance from the physical usb crowd for FIDO?

mawise• 4 years ago

Good on you for offering another passkey solution! I really want more non-Google/Apple options. I'll check it out.

lenova• 4 years ago

Heya! I just tried installing Bulwark on my Windows 10 machine. Install went fine, but when I try to run the app, I get the Admin privilege prompt, and then.... nothing. No sign of the program crashing, or any kind of error.

Any ideas? Thanks!

pabs3• 4 years ago

Apparently it is possible to make WebAuthn phishable:

https://mjg59.dreamwidth.org/62175.html https://news.ycombinator.com/item?id=33810984

wharfjumper• 4 years ago

That seems interesting. What's the license? I couldn't see that in the repo [1]

1. https://github.com/bulwarkid/bulwark-passkey

Narushia2• 4 years ago

Sadly, the demo didn’t seem to work on my devices. Tried it on desktop Chrome and my Android phone (Galaxy S22); Chrome says that a "notification was sent" to the phone, but there’s nothing. Seems like it’s supposed to work wirelessly, but I didn’t have any success via a USB cable either. Android Chrome does react to it, and shows that it’s connected, but desktop Chrome’s dialog keeps just spinning until it times out.

judge20202• 4 years ago

Wireless is over BLE, so your motherboard needs to be recent enough to have it, or if you have one of those Intel PCIe wi-fi adapters, the USB2 cable should be plugged in to a header on the motherboard (the wifi functionality is pure PCIe, but for some reason Bluetooth is over USB).

SuperSandro2000• 4 years ago

But to secure my hardware security key I need a PIN, too otherwise anyone can just borrow it. Also I still need a backup in case I actually lose it somewhere. And when I get recommended to reinstall my browser to fix a problem and I accidentally deleted my profile I might lose access to accounts.

longcat• 4 years ago

PassKey is great but also may cause vendor lock-in looking at Google and Apple in particular.

Does anyone have any insights to how enterprises will be managing passkeys for corporate accounts with the potential of creds being leaked to potential compromised devices.

stavros• 4 years ago

Hopefully, $20 USB keys.

aborsy3• 4 years ago

Hardware keys are better. Phone’s operating system is a huge code base. Also, iPhone’s operating system is a closed source proprietary black box.

piskerpan• 4 years ago

How do you link your hardware key to the website? You still have to plug it into a proprietary black box.

If you think your computer security is weak, it will continue to be the weak link even with with a hardware key.

aborsy3• 4 years ago

If the computer is compromised or backdoored, it will have access to private keys for websites that I access on that computer, one per each touch, not the database of all private keys. For example, I may not connect my Yubikey to some computers at all.

Hardware keys are made not to give out secret keys without physical touch.

Firmware in Yubikey is not updated, unlike over the air phone update.

presto82• 4 years ago

This is a really great user experience. One thing I wonder about is if people start logging in without their password all the time, will they slowly forget what their password is over time?

Partly to force memory reinforcement, I set the password cache time of gpg-agent on my machine to 24 hours maximum. Thus I have to enter my password once a day, which helps me to remember it; but it isn't overly burdensome.

Although maybe if one always has

joombaga• 4 years ago

That's is exactly what happened when I configured the LastPass browser extension to remember my password. I needed it to switch USB security keys and had no idea what it was. The saved password in my other browser's extension saved me.

haspok3• 4 years ago

My master password is "public" (I put it in a mail draft, also a note on my phone and printed it out on a piece of paper, just to be sure), and I have 2FA enabled via Yubikey. I never really understood why I had to always provide my master password anyway when logging in even on a trusted device, as the whole point of a password vault is to no longer have to remember any passwords... but we are getting there, eventually.

sebk2• 4 years ago

I'm not sure what service you're using, so this might or might not apply to you: Consider that some password managers use MFA to allow you to connect to their online service that will download a synced, encrypted copy of your password vault, but the vault itself is only wrapped with a key derived from your master password.

If someone was to obtain a copy of your vault, decrypting it would be trivial with a weak or compromised master password in that case.

CTAP supports an extension called hmac-secret that would allow you encrypt your vault, which would mitigate this issue (While introducing others potentially -- for instance, hmac-secret does not require user verification so anyone with your yubikey could decrypt it). Of course there are other mechanisms to encrypt a vault other than a key derived from a password that you can use with a Yubikey, like PGP, but I don't know of any commercial password manager that does it that way.

presto82• 4 years ago

You bring up good points: ideally, there would be no need to remember a passphrase at all! Especially since the passphrase has to be long and unwieldy in order to be resistant to offline dictionary attack.

The thing I worry about is that the security of the passphrase is only as secure as the mechanism guarding it. If it's written on a piece of paper, then how is the paper secured? It could be put in a vault, but then the vault itself is a conspicuous target for thieves. Hiding the paper somewhere is probably pretty reasonable, but if it's too well hidden, it could get forgotten or accidentally thrown out over time.

I use a YubiKey as well as an ultimate backup, and it has a PIN code mechanism that will lock after a few incorrect attempts, so that is a reasonable tradeoff for security and usability I feel.

I wonder if the best solution is to have a distributed copy of a recovery passphrase to friends and family. Then separately have a distributed copy of the vault itself (in my case, it's GPG-protected Password Store). This must have been an area of study already, I need to do some research!

dengolius• 4 years ago

Bitwarden can't import my ssh keys from lastpass export <facepalm>

it say: [1198] [SecureNote] "username id rsa ssh": The field Notes exceeds the maximum encrypted value length of 10000 characters. But this id_rsa has only 1415 symbols

1password has imported csv as well without any issue or alert.

So login from device is not a big deal.

Always42• 4 years ago

yes, then I can help my family reset 1 less password...

denhaus• 4 years ago

Am I the only one who just cannot STAND MFA? Having to get a notification text etc. Like what if I don’t want to give an app capability to notify my phone? What if I want something totally NOT connected to my phone?

I just envision a future where there is some near-circular dependency of passwords/phrases/notifications/authenticators/keys/email verifications etc across different devices and services - the end result is that it is absolute PiTA to log into anything or recover any account if anything is ever lost. Sort of an endless personal bureaucracy for authentication. It’s a future I am personally trying to avoid at all costs

Yubikeys etc seem like something I could potentially get behind, but it still doesn’t seem perfect persay… anyway, maybe I am just a geezer

badrabbit• 4 years ago

That's why I like TOTP, you can use a phone (i have a dedicated disconnected phone for it) or an rpi, hardware dongle,etc.. but it is phishable

Tidal5474• 4 years ago

MFA is not going away, but neither is it going to become what you are describing.

MFA using an SMS is not secure.

If people reliably made good passwords and never reused them, we probably wouldn't need MFA as much.

Unfortunately, we live in a society. Bitwarden will remember your TOTP codes for you across any device you login from. It will even copy the code to you paste buffer during a login.

I enable MFA everywhere i can, even for stupid stuff. Its just not an inconvenience using bitwarden.

martin_a3• 4 years ago

MFA using an SMS is not secure.

Why not? Is it that easy to intercept a SMS or is that just due to poor handling with some providers?

jbverschoor• 4 years ago

and if developers would always mitigate brute force attacks/limit the amount of attempts you can do.not limit the amount of accounts you can try to access from a single source

and it’s all developers will give you the tools to check every login session, including ip addresses used, and number of failed attempts

and off everybody uses full disk encryption and other measures so that your passwords cannot be stolen, such as only use signed applications and proper sandboxes

mightybyte• 4 years ago

Passwords, credit card numbers, social security numbers, etc are old outdated technology that can't go away fast enough. They're unfixably insecure...identifying yourself to someone by giving your secret identifying information to them immediately allows them to impersonate you! We've had the technology to fix this problem for close to 50 years now: public-key cryptography. We can't get to a password-less world fast enough IMO.

I know a lot of HN doesn't have much use for blockchain, but if there's one thing that blockchain has done for the world it's been to substantially spur the use and development of public-key auth systems, especially on the UX front. This is because it had no choice. If you try to use an inherently broken password auth system for completely decentralized digital currency, it will immediately descend into unusable chaos because of the vulnerability. Traditional finance (credit cards), government identification systems (social security), etc have so much existing infrastructure that innovating in this area is hugely costly and slow, but it's absolutely the direction we need to go.

yakubin2• 4 years ago

I’d think SSH (indirectly: git) and TLS would be more widespread applications of public key cryptography.

LopovJack• 4 years ago

What you are talking about? I reset user's forgotten passwords daily. People can't remember simplest of passwords and you can easily ask them to give you their passwords if you are persuasive enough. Human brain is weakest link not passwords, credit card numbers or social security numbers. They are just fine and will be for a long time.

flippinburgers• 4 years ago

You should give yubikeys a try.

account-5• 4 years ago

How long before you need 3 devices to log into something?

Like the other commenter I don't want or need MFA. It's more complicated and a pain to use. Just seems like a convenient opportunity for online companies to gather more data points about you. Keepassxc with a key file is still going strong for me. You've no need for my phone number! And I don't want my device linked to any account.

blitzar• 4 years ago

It is off by default.

rwky• 4 years ago

Hopefully you can turn this off. I've seen cases where attackers enter an email address and just keep spamming the login form until the owner accepts the notification. Obviously 2fa would help here but not everyone uses that.

U1F984• 4 years ago

The option is only available for known devices, which should make it more difficult to pull this off.

haspok3• 4 years ago

This option is turned off by default, as mentioned in the blogpost.

haspok3• 4 years ago

Does this also work with the Firefox plugin? Can't wait to get home and find out...

Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

Related Stories