Biometric authentication without full desktop app

Feature Requests Password Manager
1

Feature name

  • Biometric authentication without full desktop app

Feature function

  • I want to use the biometric authentication without having to log in to the desktop app first.
  • It seems unnecessary to me that the desktop app has to cache the Vault locally and also be logged in so that it can perform the browsers biometric authentication. From this point of view, two logins are necessary.
  • It may be possible to install only a agent that can be triggered by the browser extension, to handles the biometric authentication.
1 Like
2

I think it’s a security feature of the OS so you can’t have it. The same applies to 1-password

3

Why should it? In terms of authentication, the agent has the same functionality as the desktop app, but without Vault. This means more security :wink:

4

At the current moment its really about access levels and APIs to Hello/Touch ID - the desktop app is the most reliable way to connect to those APIs vs. browser-based integration. Though, there is a point in having the desktop be the ‘central station’ for convenience :slight_smile: - but that is more of this feature.

We’ll see how the browsers progress with support for Biometrics, though!

5

Maybe my request was misunderstood. I think I understand the reason why an app is needed so that the browser can access the biometric API through it. That’s ok, the problem is why does the app need to be sign-in to bitwarden first and also include the full vault? The agent I’m describing would still be a Win32 app that accepts the authentication request from the browser and communicates with the Windows API, but it doesn’t require any additional bitwarden login and no vault.

6

It would be great if users could unlock their vault through the Bitwarden browser extension without having to open the Bitwarden desktop app (or even without having the desktop app installed at all).

Is this something that is even technically possible? I think so but I’m not sure.

Nevertheless, if it’s possible, this should be implemented, as it can only benefit users (if it is not at the expense of security compared to the previous implementation where the desktop app is needed)!

7

It’s not currently technically possible to have biometric authentication in browsers without a native companion app.

1 Like
8

Thanks for clarifying!

1 Like
9

Is this now possible with passkeys? Save a passkey to access bitwarden, and use it to login to the extension? That should use the operating system’s authentication.

10

I see some messages stating it’s not possible for security reasons.

I regularly use different websites that offer biometrc authentification without any desktop agent.
When logging to these website, a popup comes calling “Windows hello”. As far as I know, it looks like a key is registered on website or computer side.
Whatever the technical details, I can assure it involves only the web browser, and not any desktop companion app.

Logging onto my bank account is as follows:
After giving my user name, the web page says: Connecting…
A popup opens on top:

  • The window title is “Windows Security”
  • Text is: Sign in with your passkey to “####.com” as “#####”.
    This resquest comes from the app “chrome.exe” by “Google LLC”.
  • I can scan my fingerprint or choose different authentication method as for opening my windows user account (face, pin, etc…)
  • Once identity verified, popup closes and webpage unlocks, account is logged

The window popup is clearly a call to “Windows Hello” service made from the browser.

11

The biometrics themselves are not being “sent” to the website. The biometrics are being used by the windows chrome executable to authenticate you to chrome to decrypt your chrome-vault containing a passkey that is then used to login to the website.

This is very similar to how bitwarden does it, but with the difference that Chrome does not allow extensions to access windows hello, so the Bitwarden extension has to ask the bitwarden executable to it on its behalf.

1 Like
12

Thank you DenBesten for the very detailed feedback about the technology behind.

You are right, I can confirm that any website that offered this authentication informed me that a secret key was to be saved into the browser. This probably refers to the key saved into the chrome vault you are talking about.

If I understand well, what prevents bitwarden to act as those websites if the fact that Chrome does not allow extensions to access windows hello.
I don’t know if the Bitwarden extension could communicate with an authentication web page that does the call to windows hello…?

I don’t know what are the technical possibilities or limits. But from the user point of view it could be really much more user friendly to authenticate without any additional software (if feasible…).

13

The webpage also can not access hello. It is chrome’s vault, that is accessing hello before releasing the secret key to the web page.

Kinda like the guard buzzing you in instead of giving you a key to the door.

1 Like