Add U2F emulation

Let’s have a type of user and a threat model in mind. If a user is naive enough to ignore that Bitwarden doesn’t recognize the URL or the fields, and manually fills in fields without carefully inspecting the URL, that person will find other ways to hurt himself, and really ought be using hardware U2F. If the threat model includes a highly motivated attack such as network sniffing and a dummy CA, again, we should be using hardware U2F, because the attacker also likely has the ability to hack directly into our own machine.

I can see a very tiny segment of users who don’t need the security of hardware U2F but do need better security than TOTP. That would be, maybe nine or ten people worldwide. Everybody else either needs hardware U2F or is sufficiently protected with TOTP.

Ultimately, every additional feature in Bitwarden requires implementation resources. I don’t see much of a payback in software U2F. I see a much greater payback in nested vaults, full backups and larger field sizes.

1 Like