I successfully changed my Master password the other day. To ensure that I knew the new password, I first wrote it into a cell in Google Sheets. I then copied the text and pasted it into the New Password and Confirm Password fields. However, when I next tried to log in using the value that I stored in Google Sheets, it didn’t recognise my password. I was a bit shocked as I didn’t think it necessary to export my database before the change. Now I have to rebuild it from scratchh.
I would like to suggest a solution to this problem.
– When the user inititiates a change to the Master password, Bitwarden would copy the
current Master password and store it separately
– After the Master password is changed, Bitwarden would have both the new and the
previous Master passords available
– In the event of being locked out, as I am, the user would request a rollback to the
saved previous Master password
– The rollback would need to be validated e.g. by two-factor authorisation
– The input to the rollback would require the user to type the previous Master password
so that it can be checked with the saved value, which is another level of security
First, that’s unfortunate how things turned out for you here.
As you indicated, it is recommended to always make an export first before you change something important with Bitwarden, like the master password, KDF etc.
I personally wouldn’t use something that may leave unencrypted traces of data somewhere, either…
Just FYI, that would mean a serious change in Bitwarden’s security architecture - and would make it far less secure - as part of Bitwarden’s security is, to not store the master password at all.
The Bitwarden master password is not only for “authentication” to the vault, but is also the main part of the encrypting/decrypting processes of the vault. To give up zero-knowledge, is no small request…
Rollback is already possible, but only in cases of vault data corruption resulting from technical glitches on Bitwarden’s side. Unfortunately, this option is not available as a way to recover vaults lost due to “user error”.
Regardless, the description of the events that led to your issue seem strange. When you attempted to log in, did you again copy the master password from the Google Sheets documents? (By the way, there are all sorts of security issues around how you’ve set up your master password, but that’s a discussion for another day.)
Did you attempt to do any troubleshooting? There are several potential sources for your problem that would be solvable:
This is something that I can not really comprehend. That an access from a blocked IP address results in a “wrong email or password” message is something trully baffling.
I really couldn’t believe it when I read it a couple of days ago.
Not giving away information to bad actors about why a login attempt is rejected is something that I can understand.
But flat out lying to your legitimate users is plainly wrong.
When I get that message, how am I going to know if my credentials are indeed wrong or I have been hit by a bitwarden server false positive?
Furthermore, If I get that message after a master password change I am going to assume that I did something wrong and go ahead an delete my account and restore my most recent backup (If I have one). Losing the changes made to my vault since that hypothetic backup.
Perhaps change the message to “authentication failed”. That would avoid sending the authentic user down the wrong rabbit hole without divulging information.
You have already lost this game. I can tell if an account exists simply by trying to sign up for it and noting if it says it is taken.
I really hope they don’t do that. A legitimate user needs to know why he can’t login to his account. And given that these IP blocks are prone to false positives he would not be able to be sure.
I really believe that the measures to limit information leakage to bad actors should not come at the expense of possibly misleading legitimate users.
This is absolutely true! I hadn’t thought about it.
I completely agree, but absent improvements to provide accurate detail, I would rather they at least do not provide misleading details.
Another possibility would be to email excruciating detail to the email-of-record upon failure. Given the email communications channel is “more controlled” than the browser channel, there is little risk disclosing if it was the password, the username, the totp that were incorrect, wrong vault, etc.
Thanks for your response. Here’s my answers to your questions:
– Wrong server domain selected.
A: I tried both servers
– Wrong username entered.
A: It’s my email address
– Characters altered or appended during copy/paste.
A: I tried copying from the cell and also the text bar
– False-positive server-side block of IP address.
A: I don’t know what this means
– Corrupt app.
A: I was using my Windows laptop
I think I’ve tried everything possible. I’ll have to delete my vault and start again.
Uninstalling and reinstalling the Bitwarden app (or browser extension), and/or attempting to log in via the Web Vault (instead of a locally installed app/extension).
Contacting customer support to have them check if there is a reason why your account cannot be accessed.
I tried some of them. However, I’ve already deleted my vault and started building it again. Luckily, my wife has her own vault which is a subset of mine and I’ve imported hers so I have a good starting point.
Is there anything remaining in this thread that you would consider to be a relevant proposal for a new or improved function in the Bitwarden software?
If so, please clarify the specific feature development that you are requesting. If not, I will move this thread to the Ask the Community section of the forum, and mark the thread as solved.
My final suggestion is that when a user begins to change their Master password it would be good to remind them to export their vault before proceeding. Otherwise, that’s it from me. Thanks again for your advice.
