I reinstalled windows on my PC and I have tried to gain access to my BW. Ive misplaced the master password and there is no hint. There used to be a scan QR to login but it’s now not available. I can’t seem to login via a device.
Just wondering what other options I could try before having to manually export the many many passwords I have.
I am afraid that feature probably belongs to another password manager.
I can’t seem to login via a device
You can only use “Login with device” after you have successfully logged in with a password once. Without a password, you can’t set up “Login with device” for that new client.
there is no hint
If you have put in a password hint in the Bitwarden web vault in the past, you can “Get master password hint” (under the password entry field) emailed to you.
Failing that, mostly you need to jog your memory about your master password, or about where you might have written it down in the past.
If you had a “login-with-passkeys”-passkeywith encryption (!), you would be able to login to the web vault without your master password… But though it is a painful message: without your master password, your account is essentially “lost”, as some core functions don’t work without the master password (e.g. like changing the master password - and of course, if you don’t have a login-passkey: logging in).
So, if you are still logged in in one ore more Bitwarden apps: stay logged in there, disconnect the device from the internet, and start exporting everything (manually) ASAP.
Just a general comment - pressure has caused Bitwarden to offer so many alternatives to simply entering one’s Master Password that people aren’t building the memory retention to know it (the Master Password). Also, every additional way to “get in” without knowing the MP is yet another potential attack vector, it seems to me.
I type my MP at least 10 times a day, each and every day. I truly don’t understand why so many folks are resistant to doing so.
Back to the OP’s situation, I hope you @Adam_Said are able to salvage your existing passwords. When reconstructing your vault please create an Emergency Sheet (you can search for instructions and what it should contain) and lock it away someplace safe. Best of luck as you work through this.
@bwuser10000 Hm, I see your point about the master password… but I guess it depends on how you login (e.g. via login-with-device) and unlock (e.g. via biometrics) to Bitwarden most of the time / usually… And human memory is not reliable - you can know it, and “out-of-nothing” you suddenly don’t remember it (and I’m not even speaking of head injuries, amnesia etc.)… So, the most important thing remains, IMHO, to have the master password on your emergency sheet(s).
Thank you for the replies and that thread with all the information. I remember a few months ago I got locked out of my iPad while travelling abroad and I found the password but can’t for the life of me remember where it was placed. I looked through an old password manager and google passwords.
This will teach me, but I’m know it’s somewhere hidden (maybe too well ).
Might also give me a chance to go through the manager on my phone and do a bit of a clean up as well.
Convenience. It is always the tradeoff for Security.
I’m guessing you know how to touch type. I (playing devil’s advocate) do not. You may be OK with typing a long password 10 times a day because the keystrokes just flow out your fingers with you paying very little attention. I need to hunt and peck each character. Beyond taking longer, I have to think of each character in the password as I move my finger to the correct key. In the end, I start to forget why I am logging in.
Enter biometrics. All I have to do is touch the fingerprint reader or smile for the camera. The effort/distraction for me to smile is about the same as the effort for you, the touch-typist to move your fingers in a familiar pattern.
Overall, it is important that we minimize the friction associated with authenticating because we can trade reduced friction for more frequent authentications.
I do agree that the more authentication methods one has enabled, the greater the attack surface, but even that needs to be balanced against having alternatives incase one’s preferred method fails. Right now, I am pretty sure the OP wishes that he could smile for the camera to create an export.
We also have different behaviors and strategies for doing things. I can touch type, and I have had my master password in “muscle memory,” but I now mostly avoid typing in the master password and only review it in memory. Attack surfaces usually involve malware or local “attacks” with access to authentication methods. I think we also have different risk profiles for those.