I agree with @grb. So, only minor additions:
-
to remind of “the usual”: put at least your BW email address, master password, 2FA recovery code, maybe server region on your emergency sheet(s) – optional: login credentials to your BW email address (especially if you have the New Device Login Protection enabled)
- PS: maybe also include scenarios, where you might have an accident (or worse) and your family etc. might need access (–> up to “digital legacy”)
-
use FIDO2-2FA-”passkeys” if possible – with at least one backup (e.g. one backup hardware security key in a safe place)
-
decide for yourself if you want to use more than one 2FA method (to avoid a lockout) or use only one 2FA method (to make it more secure)
-
if you use TOTP/authenticator app: put that authenticator key / TOTP seed code also on your emergency sheet, so that you can set it up easily again, if necessary
-
test your scenario – and check it for possible “circular dependencies” –> especially ask yourself, if you could still login to your Bitwarden account/vault, if you had nothing in your hands but your emergency sheet (and obviously, make sure you have emergency sheet(s) )
- example: if you used email-2FA and realize, you couldn’t login to your email account with just the emergency sheet, then you have to change something with your setup
-
in theory, a “login-with-passkey”-passkey would also be a nice “backup login method” – but only when they can be used for all BW apps and when they get the ability to authorize all actions and could really “replace” the master password (and 2FA)
(Further) remarks for Bitwarden :
-
it would be good to be able to test if the 2FA recovery code I “wrote down” is valid or not (feature request: Test/check the two-step login (2FA) recovery code )
-
it would be good, if nobody could forget to store the 2FA recovery code (feature request: Require Recovery Code Prompt on Initial Two-step Login Setup )
-
it would be good, if we could easily rotate the 2FA recovery code (at the moment, only using it, rotates it) (feature request: Add an option to rotate the two-step login recovery code from the web vault )