Hello. I've been reading through various threads on this subreddit for a few days now about various aspects of using Bitwarden.
And in one of the threads, I came across a message that using Auto-fill fully is not the most secure method of using the web extension for Bitwarden. Supposedly, some sites can read passwords from Auto-fill (I don't remember the exact wording, sorry if it sounds silly).
In general, I have no problem using the Ctrl+Shift+L combination manually, but on some sites I have several accounts (for example, Google email), and if I completely disable Auto-fill, I will have to manually press the key combination a certain number of times until the desired login/password appears.
But, as I see it, there are several variations of using Auto-fill in Bitwarden:
1. Do not use
2. When field is selected
3. When auto-fill icon is selected
And also a separate option - Auto-fill on page load.
In general, it is very convenient for me to use Auto-fill with the second option “When the field is selected”.
Is there any risk that the site can read/steal/etc. the password when I use Auto-fill in this configuration? Or is it better to manually use Ctrl+Shift+L / copy through a password manager?
Hi I'm struggling to understand how password managers like Bitwarden that autofill your passwords keep your accounts secure in the event that someone has access to your physical device. I must be missing something here. Can someone please explain how my accounts are secure considering the following scenario?
I use Bitwarden on Chrome and have a Chrome extension. Bitwarden is set up with Autofill on page load so that when I go to a website that requires me to login the username and password pops up automatically.
I'm using my phone or laptop in a cafe and it's unlocked because I'm physically using it.
Someone unexpectedly steals my phone or laptop whilst it's unlocked.
They are then able to enter any website address they like and if I have an account my details will be autofilled when the page loads. Obviously this would be bad because the thief now has access to my bank accounts.
Furthermore the thief is able to get into my Bitwarden, simply through clicking on the Chrome extension button. This gives them access to everything stored within Bitwarden.
This seems like such a huge risk when using Bitwarden or any other password manager with autofill because as soon as someone has access to your physical device that's unlocked they also have access to your Bitwarden account and any other account you own. Bank accounts, email accounts, you name it the thief now has it. What do password managers do in order to prevent the thief having access to everything in this situation?
I'm clearly missing a lot here with regards to how password managers like Bitwarden are better at keeping people's accounts secure because to me it seems like not using a password manager might be safer. I mean if I don't use a password manager I'm forced to manually enter my account details, which means if someone has access to my unlocked physical device they don't have access to all my accounts. Sure the thief will have my device but at least they don't have access to all my account information if I opt not to use a password manager.
What am I missing? How are password managers like Bitwarden a better option than not using them?
UPDATE: So it turns out I was missing some critical aspects of Bitwarden's use that I wasn't aware of. Thanks to the community I was able to find the settings I was looking for within the chrome extension and I'm now happy with the security it offers. Yes, it's a far better option than not using a password manager at all.
I missed the setting in the chrome extension where it said vault lock was set to lock on browser restart. Since browser restarts rarely happen on my laptop it obviously wasn't safe like that. Now that I've set the vault lock timer to a much shorter duration I can see that things are starting to work as I hoped they would and as the designers of Bitwarden intended. Thumbs up from me!
I also removed the autofill on page load and replaced it to autofill with shortcut hot keys. I also changed the shortcut hot keys to something different and the usual shortcut hot keys lock the vault. I figured if someone random gets access and tries to load a password using the typical hot keys that it adds an extra layer of safety as that will effectively lock the vault if it wasn't locked already.
I'm also going to add some pepper to my most critical passwords and have made my master password plenty strong enough to withstand any brute force attacks.
I'm now confident the hypothetical scenario I mentioned earlier is not as much of a security concern as I first thought. I'll continue to spend more time learning about the functionality within the Bitwarden platform and adjust settings as necessary so that it works in a way that's suitable for my needs. Thanks to everyone who commented. Stay safe!
I had read an article about autofill phising recently and realized that the automatic autofill option is dangerous to have enabled for websites. But then I noticed on Facebook's sign in page, it has multiple fields for email and passwords because it has the sign up fields there as well as the sign in one at the top, and no matter which method I use to autofill (keyboard hotkeys, right click in the field, or clicking on the extension icon) with the Firefox extension, it always fills in both sets of fields rather than just the one I intend to. So now I'm concerned that it could also fill in hidden form fields as well. Does Bitwarden have a protection against hidden fields?
i currently use lastpass and am considering moving to a selfhosted bitwarden. one of the things that frustrates me about lastpass is that the autofill is really crappy. on android and on the web (chrome). so my question is how well does bitwarden's autofill work?
Just started using Bitwarden due to a few people I know getting their phones stolen unlocked and thieves taking control of all their accounts. If someone stole my phone or laptop, surely they would still have easy access to all my passwords as they will simply autofill on any website they would want to get into...
Am I missing something?
Hi there! I've stored my Bitwarden login credentials inside of the vault. For additional protection against phishing attacks and protecting against inputting login credentials into a fake website disguised as the official Bitwarden one, would it make sense to only login via the extension and then for the web vault just use Command+Shift+L to log in there? Or is this unsafe somehow?
I also have an emergency sheet, so the login credentials are not only inside vault.
It’s certainly okay to store your master password in the vault, and then use autofill when you need to log into the web vault. Just keep in mind that for filling in credentials to other sites, you should still be using the browser extension.
Some would argue that if you store your master password in the vault, then someone who has access to your vault will…have access to your vault? That seems kinda circular to me. If you choose NOT to store your master password in the vault, that’s also okay. You shouldn’t need the web interface very often anyway.
You could even use Bitwarden to launch your browser to the correct site, but not store the master password in there. That would satisfy everyone, I guess. But again, I don’t think what you’re doing is very bad.
My personal opinion is that your master password should be 16+ characters minimum (resist future quantum computer attacks) and exists only in your head. Don't use biometrics for auth as you can be legally compelled to use it (or get your finger cut off), but one can "forget" passwords.
In the Bitwarden documentation, there is a prominent warning that "...while generally safe, compromised or untrusted websites could take advantage of this to steal credentials." (https://bitwarden.com/help/auto-fill-browser/#on-page-load)
I also found this article, which explains a possible attack vector that seems to have been addressed: https://www.bleepingcomputer.com/news/security/bitwarden-flaw-can-let-hackers-steal-passwords-using-iframes/
I now have a few open questions that I am not quite able to answer:
-
What are the actual dangers? The warning makes it seem like if I visit any untrusted site, I run the risk of losing my login credentials if this feature is enabled.
-
Chrome and Firefox have password managers that also auto-fill on page load. If there really is an attack that allows a bad actor to extract credentials when I visit their untrusted site, wouldn't Chrome and Firefox also have this HUGE problem?