Newbie Security Question

Ask the Community Password Manager
,
1

I am going to be traveling. During that trip, to avoid having to hassle with two factor authentication on my laptop and/or tablet, I am thinking to Lock All Vaults when I have completed something in BitWarden but NOT logging out. That will avoid having to enter the 2nd factor during my trip.

My question: If I just Lock All Vaults and my tablet/laptop gets lost/stolen, can the data.json be copied and then opened by someone without having to enter my BitWarden password?

Thank you for any help that can give me.
GS

2

Hey, welcome!

No, the master password is required to export your vault. See more here: Export Vault Data | Bitwarden Help Center

3

Thanks Favi. How about just a simple Copy . . . not an export . . . just a copy?

FYI - I understand theoretically someone could eventually crack the vault with just a copy. So, in this case, my question is focused on: Can someone open a copy of data.json file in Bitwarden and/or another password manager or even some kind of software than can read a data.json file. Open it without having to enter my password?

4

No, because your data.json file is encrypted, and accessing the encryption key requires knowledge of your master password. If your master password is sufficiently strong (4-5 randomly selected words produced using a passphrase generator), then the risk is negligible.

However, have you ever created any unencrypted vault exports on these devices? If so, there is a risk that traces of the exposed secrets still exist and could be recovered from your device by a determined attacker.

5

What is your unlock method? I think this depends on the strength of your unlock method.

AFAIK If your HDD is not securely encrypted then you’re taking a risk if you have a weak unlock method and don’t log out.

6

This is true only if you set up a PIN and disable the option “Unlock with master password on restart”.

I would recommend to OP to not use a PIN while travelling.

7

A big thank you to grb and to everyone who pitched in and tried to help a newbie !! My password is beyond the 5 randomly selected words. I created that by using a passphrase generator. I do not have any unencrypted vaults on these devices. I do not use a PIN. Based on my understanding of the responses, my risk is negligible.