Authenticator Key (TOTP) toggle visibility option

Feature name

  • Authenticator Key (TOTP) toggle visibility option

Feature function

  • What will this feature do differently?
    Usually Password field has a Visibility Option when you add/edit an item but with TOTP I noticed there is no such option.
  • What benefits will this feature bring?
    There are known Malware that spy on your current desktop by taking screenshots of it and sending them online or people who would spy on you thru various means. It would be a good feature to make TOTP hidden when you are adding/editing just like in the Password field.

Related topics + references

  • Are there any related topics that may help explain the need and function of this feature?
    Not sure if there are any topics.
  • Are there any references to this feature or function on other platforms that may be helpful?
    I have tried numerous password managers, one example is KeePassXC, their client has the TOTP hidden when you are editing the TOTP Entry.

Voted

Ref. link Make "Authenticator Key (TOTP)" as sensitive · Issue #842 · bitwarden/web · GitHub

Voted, i would really like to see this feature

Additional to this feature, I would like to request that within the security options on how you can choose users to hide password access, I would like to choose to just hide access to the TOTP code if a user is given access to a password.

  • If there is a malicious party that wants to access a password protected site it would need the TOTP code, if that malicious party were to view the actual code that is pasted into the TOTP field then they would be able to replicate the TOTP code on any authenticator.
  • for general security please also add a feature in which the TOTP number generated would only be visible and not the actual code pasted into the field to generate the 6 digit code.
1 Like

Voted too, I’m in favor of this improvement.

Authenticator key should be treated like a secret by Bitwarden’s UIs — it should be hidden (replaced with * chars).

Currently, when I press ‘Edit’, password is hidden, but TOTP secret is visible. Why would I ever want to see it or partially edit it?

In my opinion there shouldn’t be a feature request necessary for this, it’s rather a security flaw to show the SECRET each time when opening the password record.
The reaction shown on Make "Authenticator Key (TOTP)" as sensitive · Issue #842 · bitwarden/web · GitHub isn’t how this should be handled.

Hi all,

It will be great feature.
Please release it.

Thank you!

Secret indeed should be never visible even with a toggle button!

If it should never be visible, how would you intend to make use of it if you have Bitwarden on one device but have to enter the TOTP on another one ?

1 Like

Peter, this feature request is about the field Authenticator Key (TOTP) that becomes visible when editing a login item. This holds the “secret” that is used to generate the 6-digit TOTP codes, which is sensitive information that should never be needed by the user unless migrating one’s TOTP to a different authenticator app (for which case a copy-paste functionality should be provided, just like when copying a password that is not visible).

Nobody here is requesting obfuscation of the generated 6-digit TOTP codes.

Thank you for correcting me.

Then please let me re-phrase this:

@JonVer:
How do you intend to transmit this piece of information in the (probably rare) case that you want to enter it into another authenticator or give it to someone ?

I’m not JonVer, and I don’t agree with the suggestion to omit the toggle button altogether, but I suppose it could be done as I described in my previous response: Simply provide a “Copy” button for the field, which places the Authenticator Key in your system clipboard. Now you can paste it into a different authenticator app, or paste it into Notepad to make it visible (if you need to enter it into a device on which you don’t have access to Bitwarden).

Just to explain my use case:
We share access to machines via Bitwarden to multiple users.
Access can be revoked, but nothing prevents a read-only user to have copied the password and the TOTP secret.

Of course, copying the password is fine by me, but if they copy the TOTP secret, revoking access is useless since they can generate the OTP via the earlier copied TOTP.

Next to that, if the secret is always visible (so no hide toggle button), means viewing the secret is not logged in the audit logs. Opposed to viewing the password, which is logged in the audit logs the moment you press the ‘view’ button.

Your point about being able to log and audit when (and by whom) the Authenticator Key has been viewed is a good one.

As far as your proposal to remove the toggle & copy buttons altogether, perhaps that could be implemented for organizations, such that the availability of the toggle/copy buttons could be configured on a per-user basis. In contrast, not having buttons for toggling visibility or copying of the Authenticator Key for anybody is a bad idea, because it would prevent users from migrating to a different authenticator app.

That’s a very good summary, I would be very happy with such solution

1 Like