Email verification required after logging in to Web Vault?

[Seth-W]

At some point grb (I believe) noted you might get an email verification request after logging to the vault in without using the master password and then attempting to perform an action that requires password verification. Perhaps it was tied to “login with device”.

I neglected to like or bookmark it. Can someone help me find this post or perhaps repeat the advice?

Thanks.

[grb]

Is it one of these comments that you are referring to?

Login with Passkey, "Use for vault encryption"

How are you logged in to the Web Vault? If you logged in with a passkey or logged in with a device, then Bitwarden is not able to use the master password for verification, and in such cases it will fall back to an email code.

Exporting vault is too easy

Yes, the email verification code is required only when a user has logged in without a master password. To me, what would make most sense is a requirement to re-authenticate (using master password, device, passkey, etc.). But with the current system, is is the user’s responsibility to ensure that the vault is locked when not in use, to prevent access by unauthorized individuals.

 

I recall that this explanation was originally provided by a Bitwarden rep, but I have been unable to find the original source.

[Seth-W]

Thank you. It was the first of the two - I missed the second one.

Using what I remembered of it I word-searched Bitwarden for it, but never found anything about it there.

Again, thanks.