Help with Verification code

Ask the Community Authenticator
1

Hope someone can help with a beginner on Authentication.

I have just installed Bitwarden extension on my wife’s User on my old laptop which she will now be using.

When we try and sign her in, we enter the username, and master password, and then it asks for
“Enter the code from your authenticator app“

I have no idea what her authenticator app is (nor does she, I do all the PC setups). I did previously install the Bitwarden Authenticator app on her Android phone, and there is an entry there on the page headed “Verification codes“ titled Bitwarden with her email address.

But every time I enter the code I get an error message saying “Invalid verification code.“

Could there be another Authenticator App?

I do get offered a chance to enter a recovery code, but I cannot see that without opening the web page.

I have a Premium account which is shared with my wife, so I’m not sure if there is anything there in account settings to help.

2

At some point, you must have gone to the Web Vault’s Settings page and enabled Two-Step Login using an Authenticator; setting this up is a multi-step process, which is highly unlikely to have been completed accidentally.

It seems likely that this is, in fact, an authenticator key for her Bitwarden account, and it should work unless one of you later disabled and re-enabled Two-Step Login with Authenticator for the Bitwarden account.

If what you have is the correct key, then the most likely reason that you are having trouble using the authenticator codes is that the system clock on your devices is not accurate (running fast or running slow, or set to the wrong time zone). Please go to time.gov, and compare the time shown by Android phone to the official time. Do the same for the laptop computer.

Yes. If the error message (“Invalid verification code”) persists after you fix the clocks on the Android phone and on the laptop, then you must have stored the Bitwarden authenticator key in a different authenticator app. This would not necessarily need to be the Bitwarden Authenticator app — there are many others (e.g., Google, Microsoft, Authy, Ente, 2FAS, Aegis, Raivo, etc.). Some of these authenticators also have desktop apps (or browser extensions), so you should check all of your phones and computers to see if there are any authenticator apps installed that may contain the relevant Bitwarden key.

Yes, you need to obtain a copy of the key when you first enable Two-Step Login for your Bitwarden account, and store it is a safe place.

If you’re both logging into the same (shared) account, then please note that this is not permitted by Bitwarden’s Terms of Service. If you meant something else, please clarify.

Are you already logged in to the Bitwarden account? If the two of you are in fact using the same Bitwarden account, then there may be a chance for you to use your own logged-in app or extension to access the Web Vault. This will only work if you can find a web browser that you have previously used to log in to the Web Vault (and where the browser data have not been cleared since you previously logged in). To attempt this approach, go to the Web Vault login page, enter your Bitwarden email address, and click Continue; on the next screen, check if there is a button labeled Log in with device, just below the button that says Log in with master password. If you see the Log in with device button, then make sure that your other Bitwarden app or extension (where you are already logged in ) is unlocked, and then press the Log in with device button on the Web Vault login form. You should then see a prompt on your other app, asking you to authorize the login.

By logging in to the Web Vault, you will be able to obtain the Two-Step Login Recovery code, and reconfigure your authenticator key (by deleting the current key, and setting up a new one).

1 Like
3

Hi grb,

Thanks so much for such a detailed post. That must have taken a while to compose.

I’ve printed your answer of in full to work through it, but I may not get time to do so till tomorrow.

One point I will respond, is we do have separate log-ins. I said shared as that is the phrase Bitwarden use on their plans page as “share vault items with one other user“. Sorry for confusing you.

Now to work through your so helpful answer.

Thanks again

Colin

4

Thanks for clarifying.

In that case, the last paragraph in my previous response (about “Log in with Device”) will not be applicable.

In addition, you may have an authenticator key for two-step login into your own Bitwarden account, and this key will not work for your wife’s account, and vice versa.

Hopefully, this is all just a straightforward matter of correcting the clocks on your wife’s devices.

1 Like
5

Problem solved!

I looked at the authenticator app on my own phone. It showed exactly the same 6 digit code as her phone/app did. But in addition, there was a second entry titled Bitwarden.

Tried it and immediate access was granted.

Now all I need to work out is deleting the double entry from my phone, and the wrong entry from her phone.

Looks like that needs to be done in the vault somewhere.

6

Hi grb

Thanks very much for your time and help. Really appreciated.

Colin

1 Like
7

If I understand you correctly, then that has to be done in the Bitwarden authenticator app locally…

… unless you sync those codes with your Bitwarden vaults… (and in that case, also be aware of the circular dependency of this setup)

General suggestion: consider writing the TOTP seed codes down on your emergency sheets, beside at least your vaults email addresses, master passwords and 2FA recovery codes.

8

You’re welcome — glad I could help.