What will this feature do differently?
Usually Password field has a Visibility Option when you add/edit an item but with TOTP I noticed there is no such option.
What benefits will this feature bring?
There are known Malware that spy on your current desktop by taking screenshots of it and sending them online or people who would spy on you thru various means. It would be a good feature to make TOTP hidden when you are adding/editing just like in the Password field.
Related topics + references
Are there any related topics that may help explain the need and function of this feature?
Not sure if there are any topics.
Are there any references to this feature or function on other platforms that may be helpful?
I have tried numerous password managers, one example is KeePassXC, their client has the TOTP hidden when you are editing the TOTP Entry.
Additional to this feature, I would like to request that within the security options on how you can choose users to hide password access, I would like to choose to just hide access to the TOTP code if a user is given access to a password.
If there is a malicious party that wants to access a password protected site it would need the TOTP code, if that malicious party were to view the actual code that is pasted into the TOTP field then they would be able to replicate the TOTP code on any authenticator.
for general security please also add a feature in which the TOTP number generated would only be visible and not the actual code pasted into the field to generate the 6 digit code.
Peter, this feature request is about the field Authenticator Key (TOTP) that becomes visible when editing a login item. This holds the âsecretâ that is used to generate the 6-digit TOTP codes, which is sensitive information that should never be needed by the user unless migrating oneâs TOTP to a different authenticator app (for which case a copy-paste functionality should be provided, just like when copying a password that is not visible).
Nobody here is requesting obfuscation of the generated 6-digit TOTP codes.
@JonVer:
How do you intend to transmit this piece of information in the (probably rare) case that you want to enter it into another authenticator or give it to someone ?
Iâm not JonVer, and I donât agree with the suggestion to omit the toggle button altogether, but I suppose it could be done as I described in my previous response: Simply provide a âCopyâ button for the field, which places the Authenticator Key in your system clipboard. Now you can paste it into a different authenticator app, or paste it into Notepad to make it visible (if you need to enter it into a device on which you donât have access to Bitwarden).
Just to explain my use case:
We share access to machines via Bitwarden to multiple users.
Access can be revoked, but nothing prevents a read-only user to have copied the password and the TOTP secret.
Of course, copying the password is fine by me, but if they copy the TOTP secret, revoking access is useless since they can generate the OTP via the earlier copied TOTP.
Next to that, if the secret is always visible (so no hide toggle button), means viewing the secret is not logged in the audit logs. Opposed to viewing the password, which is logged in the audit logs the moment you press the âviewâ button.
Your point about being able to log and audit when (and by whom) the Authenticator Key has been viewed is a good one.
As far as your proposal to remove the toggle & copy buttons altogether, perhaps that could be implemented for organizations, such that the availability of the toggle/copy buttons could be configured on a per-user basis. In contrast, not having buttons for toggling visibility or copying of the Authenticator Key for anybody is a bad idea, because it would prevent users from migrating to a different authenticator app.
Passwords are hidden when editing login information in all of Bitwarden apps. However, the TOTP secret isnât, making me feel rather unsatisfied having the Authenticator Key in plain.
When I go into the vault to get my password and TOTP key, the TOTP key is shown in plain text. Can this be hidden by default? It doesnt make sense to me to leave this plain text but have the password field hidden until you click the âviewâ bitton.
