2025.11.1 Release Notes

[Nail1684]

@marlin

Is it possible to limit this to unlocking or at least require one previous login with master password and 2FA?

1. I can’t answer that (no insight into BW’s developmental processes).
2. Sounds like a feature request.

@marlin

Otherwise, in case someone obtains my hardware key, all that stands between the attacker and my vault is a (short) PIN.

Well, given your PIN is random – and not absolutely too short – the risk might be smaller than you think. Also, because e.g. with YubiKeys, after 8 failed attempts, the FIDO2 function of the key gets blocked entirely. (I can’t say, if every hardware security does it exactly the same as Yubico)

If you still don’t feel your PIN would be strong enough – then make it stronger:

YubiKey Login PSA: Set a strong PIN!

With passkeys becoming more prevalent, and with the ability to store passkeys on hardware security keys (e.g., YubiKeys) for passwordless login, it is imperative to set a strong FIDO2 PIN on your security keys. Otherwise, someone who has stolen or found one of your security keys may be able to brute-force guess the PIN, which would reveal information about what accounts can be accessed with the key (see screenshot below): [image]   Thus, if you are using a security key for passwordless login…