Is this email authentic: Action required to maintain your Bitwarden account

@Quexten Thanks @Quexten for that info! :clap: – And if it is designated for an US account, then some things do look less suspicious already.

I think @Neuron5569 raised some good points about the differences between this and other legitimate BW mails - maybe would be good, to have less such differences…

PS: And it may be good (for everyone involved), that things like this should be made more (earlier!) public in the future.

This is the key to the puzzle, and having had this information from the start would have certainly steered our analysis in a different direction.

It may be possible that @r722d never had a US bitwarden.com account, but that someone created an account back then, using @r722d’s email address (to check whether an account existed, for purposes of further cracking attempts).

@r722d If you deny (or don’t recollect) ever having registered for a Bitwarden account prior to 2019 2017, could you please clarify the following?

  • If you run a Data Breach report on the email address to which the Bitwarden message was addressed, does it show up in any data breaches?

  • If you submit the email address (to which using the Bitwarden message was addressed) using the account deletion form at https://vault.bitwarden .com /#/recover-delete (NOT https://vault.bitwarden.eu/#/recover-delete !!!), do you get an email message with instructions for how to delete the account?

Thank you for these points, I’ve passed this thread along.

PS: And it may be good (for everyone involved), that things like this should be made more (earlier!) public in the future.

I’ll note that as far as I’m aware, the few users that are still on this encryption scheme have been contacted multiple times before. This was not a public announcement but should be known to the affected users at least.

… at least we now know, you reside in Delphi. :laughing:

Hi everyone,
Thanks for the many helpful comments. I can actually shed some light on the situation and clarify things. The hint about an old Bitwarden account was helpful. I did indeed have an old account on the .us instance. I was actually convinced that I had permanently deleted it. I have now done so using the method described.

Sorry for any confusion I may have caused.

However, I don’t remember receiving any prior information from Bitwarden regarding this necessary step.

From a user’s perspective, I find the communication in such a sensitive area could be improved. It was not clear to me that this was an official Bitwarden email.
It would help to include a contact address for any questions instead of using no-reply…
And I will never, ever, ever click on a link in an email that is supposed to take me to my password vault.
A simple note should suffice to instruct users to log in to the Web Vault through the usual, trusted method and start the migration from there.

Stay safe out there. Thank you community so much for quick support!

This right here is the crux. And, ā€œany questions, contact supportā€.

And additionally some simple ā€œlinkā€ (that you also don’t have to click in the email but can easily type in yourself) to a corresponding info text on the Bitwarden website, like:

If you want to know more about this change, go to https://bitwarden.com/legacy-encryption/ (or whatever link it could be)

That info text then could be like the one that @Micah_Edelblut posted after our discussion: Deprecating support for legacy accounts

→ that way, everyone who received such a mail, could easily check the content and validity of that mail with an official info on the official Bitwarden website