@Quexten Thanks @Quexten for that info! ā And if it is designated for an US account, then some things do look less suspicious already.
I think @Neuron5569 raised some good points about the differences between this and other legitimate BW mails - maybe would be good, to have less such differencesā¦
PS: And it may be good (for everyone involved), that things like this should be made more (earlier!) public in the future.
This is the key to the puzzle, and having had this information from the start would have certainly steered our analysis in a different direction.
It may be possible that @r722d never had a US bitwarden.com account, but that someone created an account back then, using @r722dās email address (to check whether an account existed, for purposes of further cracking attempts).
@r722d If you deny (or donāt recollect) ever having registered for a Bitwarden account prior to 20192017, could you please clarify the following?
If you run a Data Breach report on the email address to which the Bitwarden message was addressed, does it show up in any data breaches?
If you submit the email address (to which using the Bitwarden message was addressed) using the account deletion form at https://vault.bitwarden .com /#/recover-delete (NOThttps://vault.bitwarden.eu/#/recover-delete !!!), do you get an email message with instructions for how to delete the account?
Thank you for these points, Iāve passed this thread along.
PS: And it may be good (for everyone involved), that things like this should be made more (earlier!) public in the future.
Iāll note that as far as Iām aware, the few users that are still on this encryption scheme have been contacted multiple times before. This was not a public announcement but should be known to the affected users at least.
Hi everyone,
Thanks for the many helpful comments. I can actually shed some light on the situation and clarify things. The hint about an old Bitwarden account was helpful. I did indeed have an old account on the .us instance. I was actually convinced that I had permanently deleted it. I have now done so using the method described.
Sorry for any confusion I may have caused.
However, I donāt remember receiving any prior information from Bitwarden regarding this necessary step.
From a userās perspective, I find the communication in such a sensitive area could be improved. It was not clear to me that this was an official Bitwarden email.
It would help to include a contact address for any questions instead of using no-replyā¦
And I will never, ever, ever click on a link in an email that is supposed to take me to my password vault.
A simple note should suffice to instruct users to log in to the Web Vault through the usual, trusted method and start the migration from there.
Stay safe out there. Thank you community so much for quick support!
And additionally some simple ālinkā (that you also donāt have to click in the email but can easily type in yourself) to a corresponding info text on the Bitwarden website, like:
If you want to know more about this change, go to https://bitwarden.com/legacy-encryption/ (or whatever link it could be)
ā that way, everyone who received such a mail, could easily check the content and validity of that mail with an official info on the official Bitwarden website