Bitwarden plans to try introducing Device Verification a second time after pulling back from the last attempt in 2022, and people are understandably upset because most of their email providers also enforce a system like Bitwarden’s Device Verification, and it makes it possible for one to be entirely locked out of their Bitwarden account, and subsequently, every online account they have if they don’t specifically plan for accounting for the Device Verification workflow.
I think it may make more sense to have a waiting period, where after a duration of time has passed, the device will be automatically considered as verified. More details are available in this post, which I have reproduced below:
When designing this feature, were there any thoughts about making it so that unrecognized devices are subject to a waiting period (e.g. 2 days, but adjustable by the user) before getting auto-approved? The user will get notified about the unrecognized device, via emails, notifications in the desktop/mobile app, notifications in the browser extension, etc. and can either explicitly accept the device as verified to skip the waiting period, or reject the device (and then change the vault password if needed). That way, in the worst case scenario where the user can’t access their trusted devices, the only consequence would just be an annoying waiting period as opposed to being 100% unable to access their vault.
