✅ Account Switching

Uploading/distributing a second client build - at least for desktop chrome/ff/etc. - should be trivial effort. (I’m doing that for my own build to have an alternate client installed, but that’s not suitable for average user.)

As as been suggested before - you could even just call it a ‘beta’ client if you wanted to keep it easily distinct.

This would at least be a good mitigation for non-developer users to be able to use two distinct bw accounts.

Work and home have become so intertwined, and if I need to work from home and have my personal cell it is a real hassel, just as the op describe.

Something as simple as watching a webinar after work can be ruined by getting late just because I had to stop and switch account. Because the login is on my work account not my personal.

Privacy and zero-knowledge is key, but I’m stuck in world where I have work-logins on my work-account and personal logins on my personal-account, with no easy go between.

And adding every login to the other account is just a big no-no. A simple export import might do the trick for some people, but it is a matter of principle to store the logins separate. I should not have access to my work logins if I decide to quit my work.

3 Likes

One large issue I had with another company’s implementation was that joining a family plan took over my personal account. I want to have personal vault that stays distinct from the any group I join including a family plan.

3 Likes

This feature is also holding me back from choosing bitwarden. I already use it for a small client, which has self-hosted bitwarden vaults. But now I need a password manager for work, necessarily for my work notebook + private pc. And I’m even thinking of moving my privat credentials to a new location.

I don’t want to complain. Just adding my view about the importance of this.

(Maybe combined with the missing possibility for offline credentials editing. But I didn’t knew about that a moment ago – why do I have to stumble over this in the forum btw? “Only update/store credentials when online” should be written on the homepage and in every review! Whatever… . Both features are necessary for me.)

Someone posted this in 2020, yet. :wink:

It’s a large task for sure - we’re working on it :slight_smile:

2 Likes

Hi @tgreer There were mentions of this being working on and it even seems to be on the roadmap for Q3 here: Bitwarden Roadmap

Just curious if it’s still expected to be released by the end of Q3. I would like to champion bitwarden for my team to use but this feature needs to be release soon for me to be able to do so. Or else I don’t think my team would adopt it.

Dev will start in Q3, we’ll see how fast we can get everything wrapped up :racing_car:

1 Like

Currently if I want to switch between the Bitwarden instance we’re hosting at work and my cloud hosted personal one I have to do log out entirely, change the server address, log back in and go through 2FA.
It would be sweet if I could have both accounts saved and just have to unlock the vault I want to use with my master password and save all the clicks and typing.

Please check this request:

Heya, not the same thing. I wouldn’t want any linking to be happening, or deciding on any direction. This is purely in the clients and nothing else. I SHOULD have to do this manually in every client, as there are desktop clients I use on machines that are only for work and others only for personal.

I agree with @jvacek, these requests are different. I don’t want to have accounts merged or linked (or whatever you want to call it), but I do want to be able to switch between accounts quickly, particularly in the desktop and mobile apps. For browser, I have different profiles, so it’s no problem.

This would be huge!

It is precisely because of this capability being taken out of RoboForm that I started looking around at other options.

Highly motivated by the open source foundation has me making the transition to Bitwarden combined with what appears to be solid execution.

In RoboForm, they was called “Profiles”.

On the desktop interface, I could see it easily added just above the ‘Logout’ option within the ‘Account’ pull down menu. It could be titled ‘Switch Profile’.

Hope you consider this. I would love to see it added.

This is a big one for me as well.

I’m currently using a different password manager (1Password) at home and on my mobile. I do NOT want to put that account information on my work computer since I don’t have total control over it and I don’t really know who may have access to the data on my machine.

So, I had been using the browser’s own “save password” feature but that is a pain as I’m a web developer and have to test with different browsers and using the brower’s password manager, all my passwords are only in the one browser.

So, I decided to give BitWarden a try for my work setup and I am loving it! It only contains my work account passwords so if anyone were to get access somehow, I’m not really too concerned as it is just work related stuff.

But, the one issue I have is that I can work from home sometimes as well as do some work related stuff on my mobile. So, I need access to my work account passwords at home as well as on mobile.

To accomplish this, I have to keep using both 1Password (for personal info) and BitWarden (for Work related info).

I’d LOVE to just use BitWarden and dump any other password managers (I hate that 1Password is pushing subscriptions so strongly now). But, without the ability to easily switch between accounts/databases in BitWarden, it’s really not that practical.

1 Like

Huge fan of LastPass PROFILES - perfect for families that want limited passwords on their tablets in the children’s playroom and don’t want to worry about that device having full access to all of your passwords, and also don’t want to have to setup a separate bitwarden account for each device and then manage sharing - that’s not what we’re asking for here.

However, LastPass has downgraded the security around profiles to useless - they continually fail to understand the fundamental security distinction between using something and administrating that something.

I don’t want a separate account for my kids’ phones because when they create a new account and use Bitwarden as they would be trained to do so that they will be future secure password managers when they grown up, the new website and password are assigned to their separate account and is not automatically synchronized or granted control to my account.

With separate accounts, they are … separate - what’s mine is mine and what’s yours is yours. As a parent, I don’t want my kid setting up “finsta” or “fakebook” accounts under their separate Bitwarden account and I have 1) no access to it or to know about it, 2) no way to know who they share them to - did they just share their bank account password? did they not use Bitwarden and used really poor account/password security? and 3) no way to ensure that they are backed up when I backup my account.

And worst of all, they could disconnect the account from the shared folder by copying it into their own account folder and then changing the password so that the password my shared folder knows about was changed.

With profiles, one has a separate PROFILE for each device. Each device is given direct access only to the specific entries visible to that profile - it’s like a filter applied to your vault - for that device/profile.

Now here is where LastPass gets it wrong - if you know your LastPass password (or PIN - or worse - fingerprint) - you can change your device profile to anything else you’d like - including “upgrading” your access from a limited “Netflix-only Toddler Tablet” to complete full account access (the “full” profile). Think about that when the device is set to allow USE of Bitwarden with a simple PIN or a fingerprint - and then allowing that same authentication method to “upgrade” the device profile to full access to all of your passwords belong to us.

Knowing a PIN or having a fingerprint that unlocks a device to USE the device is not at all the same as being the account owner and demonstrating you own the account .

They used to require the entry of the master password to change the profile, so that effectively, you could set the tablet/phone device to the restricted profile, allow USE with a PIN, but for the device to change any security feature (like changing the profile!) required the master password to be entered.

I said “used to”. The way it works now, is that if you can use LastPass to get to your passwords, you can change any security feature of the account. Anyone with access to your phone or tablet that can access LastPass has complete control and access to your account - up to and including changing the master password itself!

Threat model: You let me use your phone to make a phone call, so you unlock it and let me use it. I add my fingerprint to the phone’s authenticated user fingerprints. If you have “Fingerprint unlock” – for any application, including LastPass and banking apps – I have full access to them as well to grant additional devices and accounts full access to your Bitwarden vault.

So please get this one right, Bitwarden.

DEVICE PROFILES are what we want. It should always require the highest form of re-authentication available to authorize changing the browser/device profile - not the lowest form of authentication available to the device we are changing the profile for. Changing profiles is an elevated security privilege, and as such requires a higher level of step-up authentication or full re-authentication. That way the security of the limited access defined for the profile can be enforced and not bypassed.

I think they do this by adding a separate encryption key for the profile, and for each entry visible to the profile, that entry’s at-rest encryption key is encrypted with the profile key in addition to the master account key. The administrative account settings are encrypted only with the master account key, and so are inaccessible to any of the profiles, except for the master profile. Each entry is encrypted with its own key and the master password is used to derive essentially a LMK that does not encrypt data directly, only other keys that do.

1 Like

It doesn’t quite work like that anymore.

  1. You need to provide a fingerprint (or PIN code) to add your own fingerprint. The device being unlocked is not enough
  2. LastPass (which I’m currently using) and banking apps (at least the ones I use) require you to re-sign in if any of the fingerprints on the device have been changed, so this must be available through an API
2 Likes

Actually a must-have in order to stay premium with my private Bitwarden account. Implemented self-hosted Bitwarden in my company recently and expected this feature to be present already.

I don’t feel comfortable moving my private passwords, keys and other stuff to the organisations’ vault, but switching between accounts is overly complicated or needs a workaround like different profiles in Firefox. I’m currently using LastPass aside the Bitwarden extension but that actually renders my private Bitwarden account obsolete.

Would be very happy to see this feature soon and being able to use both my Bitwarden accounts.

1 Like

And that is, if your 2 accounts are on the same server. Needing to switch between servers would almost double the steps needed to switch accounts.

2 Likes

We’ve got our eyes on client-profile switching, and we’re taking into consideration the URL of hosted servers as well. Thanks for all the feedback here!

5 Likes