Hello,
the list of deviceses which my account was logged in is long (20 entries), most of them from 2024 (web app → Settings → Security → Devices).
Does it make sense to clear it regulary (with “Deauthorize sessions” from the “Danger Zone”?) Is there a negative side effect beside I have to log (with Master Password and 2FA) in the apps? Is there a way to delete single entries without deleting all at once?
Greetings,
Claus
There is not an ability to deauthorize individual entries. There is a Feature Request to add it, though. Go vote for it!
Absent an emergency, I would not deauthorize sessions without first creating an export (zip or json). But that is just paranoid me.
1 Like
… and if you “deauthorize sessions”, then there is a current bug preventing not-currently-active-clients from getting deauthorized at the moment:
And if I remember correctly, the last time I used “deauthorize sessions” I think the list of devices in the web vault didn’t get cleared by that.
I think that is a list of devices that you have ever logged in, regardless if the session is still active or inactive (logged out).
Deauthorizing isn’t going to clear that list, because it includes inactive sessions.
On our side, clearing it would probably make sense including 1) account breach 2) malware infection 3) have throwaway clients that are not logged out 4) logged into another computer that you don’t have control (oops!). If BW is centrally breached, deauthorizing the sesions would make sense as well.
2 Likes
Hmm, I see. Well, it is not clear what this list means. Why should it be important to me? I can not change it, I do not get further details about each entry.
It is even more confusing now, and something to get worried (many entries from 2024).
I know such lists form many other apps: this specific day you used this specific device to login. And it is possible to delete/remove these ones from the list (=deauthorize). But not here? Probably I missunderstand this list.
The device list is a relatively recent feature, and is not very useful in its current incarnation. It would be more useful if the “Login Status” column could at least indicate which of the many devices are currently logged in. The current implementation only shows the current Web Vault session, as well as any devices for which a “Login with Device” request is pending (and that seems to be the primary function of the list — to see if there are any pending “Login with Device” requests).
I always use Bitwarden in Incognito/Private browsers, so everytime that I log in, a new “device” is registered in the device list (as Bitwarden does not recognize devices after browser data have been cleared).
2 Likes