Reminder for Bitwarden users: Starting in February, users without two-step login (2FA) enabled will need to enter a verification code sent to their email when logging in from an unrecognized device

[forgottenflux@lemmy.world]

Bitwarden users who store their email account credentials within their Bitwarden vaults would have trouble accessing the sent codes if they are unable to log in to their email.

To prevent getting locked out of your vault, be sure you can access the email associated with your Bitwarden account so you can access the emailed codes, or turn on any form of two-step login to not be subject to this process altogether.

[eager_eagle@lemmy.world]

using a password manager without 2FA is insanity, glad they're doing it

[giooschi@lemmy.world]

Insanity is when you lose or can't access your 2FA device and you're locked out of your account.

[9tr6gyp3@lemmy.world]

Where do you store your 2FA recovery codes?

[engywuck@lemm.ee]

On Bitwarden!

[9tr6gyp3@lemmy.world]

Well thats a good way to lock yourself out of your account!

[engywuck@lemm.ee]

Well, not really. Vault is cached on your devices, so if you have it unlocked or available on one of them you can always use it to check your 2FA.

By the way, it was a joke. I also use Aegis as a backup.

[kusimulkku@lemm.ee]

Backup codes.

[iamthetot@sh.itjust.works]

That's what recovery codes are for.

[eager_eagle@lemmy.world]

insanity is also relying on a single 2FA device, ffs

• Have multiple factors
• 3-2-1 vault backups
• Setup emergency access if you have a person you trust

[giooschi@lemmy.world]

Sounds like a second password then.

[acosmichippo@lemmy.world]

...which you keep in a separate secure location in case you lose your 2FA device.

[giooschi@lemmy.world]

Why can't I keep my password in a secure location then?

[01189998819991197253@infosec.pub]

Is it possible to change emails on the account? I haven't found how...

[clusterbomb@lemmy.blahaj.zone]

It is possible here I think : https://vault.bitwarden.com/#/login

[acosmichippo@lemmy.world]

obviously you do but it can be leaked/phished or hacked in other ways. a second "factor" such as possession of a token device is a safeguard against that.

you can actually read about all this many places online, it's nothing new: https://en.wikipedia.org/wiki/Multi-factor_authentication

[acosmichippo@lemmy.world]

1. secure location in your home (physical copy in a safe or a digital copy on an encrypted disk)

2. in case of a disaster like a home fire where you lose the 2FA device and local backup: in a remote location such as an encrypted file in a cloud service or at a trusted friend/family's house.

[9tr6gyp3@lemmy.world]

I know the recommendations. Im suggesting that everyone take a look at those practices and be sure to have them implemented.

If you're not printing out the codes on paper and sticking them in a safe deposit box as a remote backup, you're absolutely risking it.

[acosmichippo@lemmy.world]

I can't believe people are arguing about and downvoting this.

[01189998819991197253@infosec.pub]

And this changes the username to the new email, too?