Voted, i would really like to see this feature
Additional to this feature, I would like to request that within the security options on how you can choose users to hide password access, I would like to choose to just hide access to the TOTP code if a user is given access to a password.
- If there is a malicious party that wants to access a password protected site it would need the TOTP code, if that malicious party were to view the actual code that is pasted into the TOTP field then they would be able to replicate the TOTP code on any authenticator.
- for general security please also add a feature in which the TOTP number generated would only be visible and not the actual code pasted into the field to generate the 6 digit code.
Voted too, I’m in favor of this improvement.
Authenticator key should be treated like a secret by Bitwarden’s UIs — it should be hidden (replaced with
Currently, when I press ‘Edit’, password is hidden, but TOTP secret is visible. Why would I ever want to see it or partially edit it?
In my opinion there shouldn’t be a feature request necessary for this, it’s rather a security flaw to show the SECRET each time when opening the password record.
The reaction shown on Make "Authenticator Key (TOTP)" as sensitive · Issue #842 · bitwarden/web · GitHub isn’t how this should be handled.
It will be great feature.
Please release it.
Secret indeed should be never visible even with a toggle button!
If it should never be visible, how would you intend to make use of it if you have Bitwarden on one device but have to enter the TOTP on another one ?
Peter, this feature request is about the field
Authenticator Key (TOTP) that becomes visible when editing a login item. This holds the “secret” that is used to generate the 6-digit TOTP codes, which is sensitive information that should never be needed by the user unless migrating one’s TOTP to a different authenticator app (for which case a copy-paste functionality should be provided, just like when copying a password that is not visible).
Nobody here is requesting obfuscation of the generated 6-digit TOTP codes.
Thank you for correcting me.
Then please let me re-phrase this:
How do you intend to transmit this piece of information in the (probably rare) case that you want to enter it into another authenticator or give it to someone ?
I’m not JonVer, and I don’t agree with the suggestion to omit the toggle button altogether, but I suppose it could be done as I described in my previous response: Simply provide a “Copy” button for the field, which places the Authenticator Key in your system clipboard. Now you can paste it into a different authenticator app, or paste it into Notepad to make it visible (if you need to enter it into a device on which you don’t have access to Bitwarden).
Just to explain my use case:
We share access to machines via Bitwarden to multiple users.
Access can be revoked, but nothing prevents a read-only user to have copied the password and the TOTP secret.
Of course, copying the password is fine by me, but if they copy the TOTP secret, revoking access is useless since they can generate the OTP via the earlier copied TOTP.
Next to that, if the secret is always visible (so no hide toggle button), means viewing the secret is not logged in the audit logs. Opposed to viewing the password, which is logged in the audit logs the moment you press the ‘view’ button.
Your point about being able to log and audit when (and by whom) the Authenticator Key has been viewed is a good one.
As far as your proposal to remove the toggle & copy buttons altogether, perhaps that could be implemented for organizations, such that the availability of the toggle/copy buttons could be configured on a per-user basis. In contrast, not having buttons for toggling visibility or copying of the Authenticator Key for anybody is a bad idea, because it would prevent users from migrating to a different authenticator app.
That’s a very good summary, I would be very happy with such solution
Passwords are hidden when editing login information in all of Bitwarden apps. However, the TOTP secret isn’t, making me feel rather unsatisfied having the Authenticator Key in plain.
It would be great if the Authenticator Key (TOTP) field would be hidden by default just like the password field is.
Hiding the TOTP secret is more important than hiding the password. I’m surprised this is not implemented yet.
When I go into the vault to get my password and TOTP key, the TOTP key is shown in plain text. Can this be hidden by default? It doesnt make sense to me to leave this plain text but have the password field hidden until you click the “view” bitton.
A post was merged into an existing topic: Restrict Access to TOTP Authenticator Key