Faster in comparison to what? Typing the master password?
I found that logging out and then using another device for logging in is a bit faster than typing the password which in most cases contains at least one typo.
Yes, what I meant was that Iām looking for a faster method than typing the master password. I would prefer logging out and using another device to log in, but I donāt have a personal computer. So, Iād like to log in without typing the master password directly, but it seems impossible without passkeys. I guess the best option is to set up a passkey and get Bitwarden Premium
I actually want to speed things up on PC. On my phone, biometric login is always enabled, but since I donāt have a personal computer, I donāt use the ālogin with deviceā feature. As you know, to use it you first need to enter the master password at least once. But once I log in to my account, I usually donāt need to log in to Bitwarden again, so itās not really an issue
Why are you logging in to your account so frequently that it matters how fast the process is?
The recommended way to use Bitwarden is to configure the Vault Timeout Action to be Lock instead of Logout, and to leave your vault logged in permanently. If you set your apps to lock instead of logging out,t hen you have the options to unlock with a PIN (i.e., a shorter password), or biometrics.
You donāt need Premium to use passkeys in Bitwarden.
I use Bitwarden on my office computer, and it doesnāt feel ethical to me to leave it always logged in. Thatās why I make sure to log out of my account before leaving the computer. Since my master password is very long and complex, typing it in every day causes me quite a bit of time loss, because I mistype it at least once a day.
So, does that mean I donāt need a premium subscription to be able to log in with a YubiKey?
Wow. By leaving the app logged in, the only impact on the computer is that the Bitwarden vault cache will occupy a few megabytes of storage space on the hard drive. If you close the app at the end of the day, there will be no electricity costs or other resource usage. Is it really āunethicalā if you occupy that fragment of disk space for 24 hours instead of just 8 hours? If so, an alternative solution may be to use the portable Desktop app, which you can install (and leave logged in) on a USB flash drive, eliminating any use of disk space on the work computer.
The use of the word āYubiKeyā in that context is misleading. It is a reference to the Yubico OTP method, which uses a Yubikey (and a connection to the YubiCloud) to generate a 44-character one-time use code, which can be accepted as 2FA by some services (including Bitwarden). This is a very esoteric method, that is rarely used ā but if you insist on using it as the 2FA for logging in to your Bitwarden vault, then yes, you will need a Premium subscription.
If you just want to use a YubiKey as a FIDO2/WebAuthn passkey (either for logging in to Bitwarden in one step, or as a two-step login 2FA factor to complement a different primary login method), then you do not need a Premium subscription.
Ah, okay, I understand, but I have one more question: Why do we need to log in at least once on the device to use the ālogin with deviceā feature? Wouldnāt it be faster if the request was sent directly to my phone and I approved it?
This is so that Bitwarden knows that the device that wants to log in is yours. What if a hacker opens a Bitwarden app on their own computer, and uses āLogin with Deviceā to send an authorization request to you (or to another Bitwarden user)? What if they do this repeatedly? There are many users who would click Confirm access by mistake, or because they want to stop the repeated notifications. Those usersā vault would be immediately compromised, if Bitwarden did not have this security requirement.
Normally, you only need to log in once for Login with Device to work. You do not have to repeat this if you restart the device, log out, etc.
I have one more question: why isnāt a method usedālike a QR codeāthat wouldnāt send continuous requests? If there were a QR code and we scanned it with our phone to log in, wouldnāt that work? Is that a reliable method?
On a computer with Deep Freeze installed, restarting disables that feature temporarily, right?
Iām not familiar with āDeep Freezeā. As long as your app/browser data are not deleted, you do not have to log in with master password again before using Login with Device.
Iām really curious about the QR code method. Can you explain why such a feature doesnāt exist? I think users who want it should be able to log in instantly using a QR code. Iāve seen many apps that use the QR code methodāwhy isnāt it used in Bitwarden?ā
Deep Freeze: A software that restores a computer to its original configuration on reboot, preventing permanent changes.
I donāt work for Bitwarden, and have no insight into their decision-making process. FYI, there is a relevant Feature Request topic, where you can lend your support.
If youāre doing the equivalent of a factory reset each time you reboot your computer, then yes, you should expect to have to login in once with your master password before you can use Login with Device.
I looked at the topic and Iām sure this feature should definitely be added. It would be especially useful for users with long and complex master passwords.
This is already possible ā with passkeys and the āhybrid workflowā. When you try to login with a passkey to the web vault, you can choose āiPhone, iPad or Android deviceā. On Windows 11 this currently looks like this:
And then you get a QR code which you can scan with your mobile device (which of course must āhaveā access to the login-passkey ā and bluetooth must be activated on both devices for proximity check)).
Perhaps update your ādeep freezeā file after having logged into your vault and locking it. This way, your computer and the Bitwarden cloud will continue to share the same ālogin with deviceā secret and since the vault is locked (as opposed to logged out), you might even be able to use biometrics.