Option to force multiple login verification steps (force “multiple" 2FA / MFA)

[Nail1684]

@George_Savlovschi

@Nail1684 Please let me know what’s confusing, I typed that up quickly.

Sorry for that long delay… one reason for that (and the “confused” smiley) was, I had the impression we are going in circles here now, at least in some regards… I’ll try to comment on some things (not all), and probably only where I don’t agree.

@George_Savlovschi

Well, unfortunately, there’s no chance of both convenience and security, at least I don’t see a product that does both well (but that may be more ignorance than lack of such products).

Yeah, well, though passkeys are not very easy/convenient in some (!) aspects, they have at least some potential to be both convenient and secure (at least in a happy place in the future).

@George_Savlovschi

@Nail1684

Hm, of course, the whole “chain” is only as strong as its weakest link. But that doesn’t make the “strong parts of the chain” also weak themselves. (PS: and those “weakest links” - like fallback/account recovery - were already weak before an account began to offer/use passkeys for authentication… That did not suddenly become weak, only because passkeys were introduced. )

I think your logic is incorrect here.
As a thief would you go for the 100kg main entrance door with 5 locks or the backwall window that you can just lift up with one arm?
The security system is as strong as it’s weakest component, not as strong as its strongest. (weakest-link).

Well, I think I literally wrote also that “a chain is only as secure as it’s weakest link”. So no argument to that and I agree to that. But nonetheless, some change has to be introduced somewhere first. – And I think I wrote before, that account recovery is something on the “radar” of e.g. the FIDO Alliance, and they think of how that can be made also more secure.

And, even if account recovery may be the weakest link - you still don’t choose “passsword123” as your password. But why, when you still have So you try to make your passwords “strong” - even if there is a weaker link. So, if passkeys make one part of the chain stronger, there is nothing wrong with that. (or put in other words: because one link is weak, it also makes no sense, to make all other links also more weak)

As written before: change naturally comes bit by bit. – Of course, it would be nicer, if the whole chain could be made stronger at once. Unfortunately, doesn’t happen.

@George_Savlovschi

@Nail1684

Circling back to the login to our Bitwarden accounts/vaults, there is another “great news”: Bitwarden doesn’t have those fallback/recovery mechanisms you (validly) mentioned. (PS: Neither for the master password nor for any of the 2FA methods or the 2FA recovery code – nor another way around those)

That is great, but in practice it did happen once that I mistyped a password and I was locked out. Luckily I keep trying and found out the typo eventually. But that is a horribly close call, this imho isn’t a good feature. We are water bags with feeble mush brains, we need backups!
I think my answer to that would be to eventually buy a BW subscription so I can unlock my account or host locally a BW server.

I don’t really understand your answer here, or rather I would say your concerns here can be remedied with an emergency sheet for your Bitwarden account/vault – and with having some “login-with-passkeys”-passkeys for Bitwarden, that can log you in to the web vault (but unfortunately, those can’t replace the Bitwarden master password for now – see e.g. this feature request: Options to allow PRF Passkeys to authorize actions and account/security changes protected by Master Password).

@George_Savlovschi

Perhaps then that the MFA options would be usable to unlock the account?

Unlock (!) with passkeys is not available at the moment - see this feature request: Unlock with FIDO2/“passkeys”

@George_Savlovschi

I tried passkeys from google, just to see what happens and I did have a good experience to unlock things faster. However you can still fallback to weaker methods like passwords and SMS as an attacker.
Also the passkey becomes useless if whatever phone you set it up becomes unusable (gonna register one on my other phone too haha, so I don’t get screwed).

But just to not lose track of the point, the issue remains where we don’t know how Google manages passkeys and what is their security is like, and we will never know unfortunately.
In which case, a very strong master password (30+ characters) may be preferable and more secure than a passkey (If one can remember it lmao )

Well, but you can store passkeys in Bitwarden… I personally also trust my Bitwarden account more than my Google account. And with passkeys in the Bitwarden vault, e.g. changing phones becomes less of a problem - you can access the passkeys as soon as you login to your BW mobile app again…

And regarding “login-with-passkeys”-passkeys for Bitwarden, I wouldn’t store them in my Google account either (but on security keys and maybe via Windows Hello in my case…).

@George_Savlovschi

In which case, a very strong master password (30+ characters) may be preferable and more secure than a passkey (If one can remember it lmao )

Well, in principle any password - that you enter somewhere - remains phishable. So there are not few who regard a phishing-resistant passkey on e.g. a YubiKey far more secure than a “strong password”.

But I would like to conclude with: I’m not really against this feature request! I think our discussion just began with my opinion/suggestion “this request would probably be implemented, if we could use “login-with-passkeys”-passkeys in all BW apps to login”. And I still think, that “login-with-passkeys”-passkeys would be as secure as master password + 2FA + another 2FA (= “multiple 2FA”), or probably even more secure.

(to the last sentence: e.g. master password + TOTP + email verification would IMHO be not as secure as a “login-with-passkeys”-passkey – it depends on how you define 2FA/MFA, or rather as a real second factor, or if you view it as “only” 2SV = two step verification, and not necessarily making use of all three factors know / have / be

PS: And to this feature request here: it remains the question if using the same factor (e.g. the knowledge factor) “twice” would even be more secure – and on the other hand, using a 2FA-“passkey” for Bitwarden is already the strongest form of 2FA for Bitwarden, and it remains questionable whether adding “another 2FA” to that would make the BW login stronger at all)