Currently, browser extension only shows TOTP countdown if you open the specific site/application listing. Recommend updating this so that the “clock” icon next to the user/password icons not only copies the TOTP, but that the icon indicates time remaining for code.
Benefit: With having to often copy the code, click in the site field (or switch apps, etc), if there is only a few seconds left, this can cause the code to rotate and result in a failed login. This also can cause users to become entirely locked from a service if they are adding 2FA, and the code rotates after copy, then the old code is entered for the service; causing 2FA to permanently fail with no indication that this has happened.
Suggest: Pie style countdown for the icon, with icon changing color to red when less than 10sec remaining.
Have you had issues with expired TOTP codes in the past? Normally, most websites will accept codes that are at least a minute past the clock timer. I think the timer is only there to warn you if you are trying to enter the code manually (e.g., you look at the first three digits, type them in, then look back for the next three digits - you don’t want the code to change before you look back).
As such, I wonder if this feature request is really necessary?
You might check the clock on your device to make sure it matches a reference clock to the second. Most websites will accept a code a bit before it is valid and a bit after it expires to deal with the realities of network latency and clock drift. Using a code just as it is expiring should typically not be a problem – presuming your clock matches theirs.
That said, turning the “clock icon” into a count-down timer does seem to be a good idea.
My system clock is updated through an internet service, I’m sure that’s not the problem. Even though the overlap should suffice, I find myself from time to time just outside that window. Not a big problem anyway, but making the clock icon the same as on the detail screen would make it so much better.
Anymore, most operating systems do sync themselves like that. Sadly, though, it is not a guarantee. I have personally encountered three failure modes:
Right now, my computer is 2.1 seconds ahead. I just rebooted, so most likely a crappy on-board clock. I am confident NTP will drift the clock back to normal over the next few hours.
Years ago, there was a cell-tower who’s clock was 10 minutes off. Whenever I got close to it, my phone’s time messed up. Got fixed after a call to their “can you hear me now?” team.
Back before public NTP servers were widespread, we had a corporate reference clock. One day, its satellite antenna failed in a wind-storm. Whole company drifted off by about 2 seconds before anyone noticed.
If you notice it particularly with one or a few sites, and after checking our own clock, you might open a support case with them asking that they expand the window by 30 seconds to “improve the customer experience”.
Currently in the browser extension I need to expand the login entry into its details in order see how many seconds are left before the code expires. Please display the remaining time on the quick copy action icon (the same way it is displayed in the login detail card) so we can see whether to wait for the next code before copying it. Few times now I copied a code from the quick copy action just to find out that by the time I pasted it into the web page it has expired.
And just FYI: Bitwarden has now - introduced with the last releases - TOTP autofill from the inline menu. See here: Use the inline autofill menu (–> click the tab “Inline autofill TOTP”) and probably here as well: Enable the inline autofill menu
