Generate Password Button/Functionality on Create Account page.
Feature function
Provide user with ability to generate a secure master password based on selected criteria during account creation.
Offer messaging on creating a stronger and safer password.
Show user the benefit of a password generator to create immediate value and buy in to Bitwarden
Would need to be added to each platform; extension, web, desktop, mobile.
Related topics + references
Having previously worked on LastPass, I know users will generally re-use an existing memorized password as their master password since it is just easier. This creates a greater security flaw as the user now may have duplicated passwords for several services and if an account with the same password as Bitwarden is compromised, all of their BW information will be also. Offering an option to generate a password for a new account/master password may steer the user away from using a familiar, duplicate password and increase security of their BW account.
Current password generator functionality from the extension may be used.
This would be nice to have and OP is right, most users will reuse a password for their master password.
The problem is what password do you generate for them? Ideally, it would be a passphrase but you need at least 6 words (8 is preferred) and most people will be turned off by something that long. And generating something like â6C?FCCf2F8!9?F?64deC5Eâ is even more off-putting.
But then again, having the user use at least 3 random words for a master password is often better than what they were using before.
One thing I would add is that Bitwarden should automatically save the password in the vault.
Agree the standard Bitwarden autogenerated password wouldnât make for a good master password IMHO. I canât remember if it comments on how strong any suggested master password is or not? If it doesnât do anything in that respect then would definitely be worth warning the user if theyâre picking something very short/simple?
I see that BW just provides a Weak, Good, Strong progress bar, but does not articulate what criteria is required for a secure master password.
My focus with this feature would be to create a stronger master password so we can avoid âsomething very short/simpleâ @metaphase mentioned, with better messaging for sure. It sounds like the âidealâ master password though may not be appealing to an average user, but it may be worthwhile to have some kind of generation, even if it is just a few words.
@dangostylver I believe your question is the one we should be asking - what password do we generate for them? Since the user has no understanding right now of what makes their password Weak, Good, Strong during account creation, maybe having a default generated password as an example of a strong password would help address this issue as well? I do agree that some may not use the feature or find it off putting, but like you mentioned, if we can provide an option to generate something better for a master password (something thats easy to read/remember - like a 3 word passphrase for example), it will increase security and avoid re-usage of previous passwords. I imagine this may require tweaking to password generator.
In principle I like the idea of giving people the option of generating a passphrase directly. This may help some to become more secure.
The details are bit more tricky. Offering the user the chance to generate one is one thing, generating one for them is another and might be considered patronising.
If it was offered I would give it perhaps as much as one day before the first person complained that they couldnât remember the passphrase and what were Bitwarden going to do a bout it.
The number of words is another conundrum. Many users might be put off by five or six words, but they might tolerate three and accept them. There is a question of whether three random words are better than password1 or whatever their favourite existing password is.
It would certainly be worth thinking a bit more about this idea, to try and think through the potential pitfalls.
The biggest problem with password managers is the master password. You pick a bad one and youâre screwed and people are not good at picking them. If people were good at picking passwords they would not need a password manager.
Iâve helped many people get started with password managers and they all canât seem to grasp what makes for a good master password no matter how much I teach them. Bad password habits die hard.
I often debate with myself if you should even remember your master password? I know it sounds crazy but no one remembers their TOTP 2FA secret key or recovery code and without either youâre locked out of your account. You could say you donât enter those as often but still a valid point.
I have family who has taken it to the extreme and uses a randomly generated master password that he chooses to not remember because itâs too long. He has it written down and in his password manager too. I mean, this is how 1Password works with the secret key. This feature request is very similar to the feature request to add a secret key function to Bitwarden.
Who knows, maybe the future will be that we donât generate our own master passwords? I do like how Dropbox Passwords does it, they give you a 12-word recovery phrase that acts as your master password. Add a PIN lock on top of that and that sounds like a great option to me. You can do this now with Bitwarden and the PIN unlock feature.
Either way, I donât know. I like knowing my master password but I also realize that I donât know my 2FA key or recovery codes. Not everyone does 2FA so this is not an issue for everyone. I guess the great thing about Bitwarden is that it gives you a lot of flexibility so maybe a robust password generator with an option that forces the user to print or write down the master password will be a good compromise?
I have all recovery codes printed out, as well as stored on heavily encrypted drives.
Long ago I manged to lock myself out of an encrypted hard drive, because I forgot a passphrase that I thought that would never forget and I never want to be in that position again. The drive concerned is now sitting in a RAID whirring away beside me as I type this. I did try to remember the passphrase that I would never forget, but there were too many possibilities to try by hand for long and it was too long for password cracking software. After a few months of occasional tries I gave up trying.
Here is what I did. My master password consists of 2 parts. The first part is a 6 letter strange word which is easy for typing or remembering, but it is not high-entropy. The second part is random 72 digits. The first part, which is also my pin, is not written anywhere except my brain. The second part, which makes password unbreakable by brute force, is stored in my computer. If someone finds these digits, it will give them nothing without full access to bitwarden server + brute force. The problem is that I had to generate the numeric part myself, by writing the following code and running it in node.js.
let crypto = require('crypto'), pw = ''
while (pw.length < 72) {
let nu = crypto.randomBytes(1).toString('hex')[0]
if ('0123456789'.includes(nu)) {
pw += nu
}
}
console.log(pw)
Obviously, this is a bad user experience if you have to use node.js and write code. So a random generator should be present in the account creation/password changing screen as well.
During Bitwarden account creation, users are asked to enter a master password. The field is free-entry. There is a password strength indicator, a suggestion to ânot forgetâ the password and an optional field for a master password hint.
As a free-entry field, a user is expected to come up with a password on the spotâŚor use one created previously. This is of course the most important âknowledge factorâ secret in the password manager, taking the place of and allowing other âpasswordsâ to potentially be immemorable.
Rather than relying on free entry, users should be offered, or even strongly encouraged, to instead use a provided password generator. For sake of memorability, this should probably default to a passphrase generator, with a dictionary in the userâs language. This would offer both enhanced security, and greater convenience. It certainly wouldâve made my own account creation several steps easier.
.
and I never want to be in that position again. The drive concerned is now sitting in a RAID whirring away beside me as I type this. I did try to remember the passphrase that I would never forget, but there were too many possibilities to try by hand for long and it was too long for password cracking software. After a few months of occasional tries I gave up trying.