News for hackers. Stuff that matters.

A comment on Bitwarden introduces mandatory 2FA for new devices. Parent comment

Re:Bitwarden introduces mandatory 2FA for new devices by Cieric on Tuesday January 28, 2025 @11:27AM (#42854197)
My personal problem is that I self host and the updated extension just completely fails to connect to my vaultwarden instance. I probably just need to repull the updated docker container, but it's something I would have rather not thought about. But since the extension auto updated I'm forced to think about it.
[ Parent | on HN ]
Re:Bitwarden introduces mandatory 2FA for new devices by horsawlarway on Tuesday January 28, 2025 @11:45AM (#42854472)
Interesting - I'm also running self-hosted and didn't have this problem (I think my last image pull was about a month ago, though - so somewhat recent).

If you want, I believe you can override the update url in chrome to stop the auto-update process in the future: https://chromeenterprise.google/policies/?policy=ExtensionSe...

Alternatively, at least for chromium browsers - you can download the .crx directly, unzip it (p7zip will do it), and sideload it using the "Developer mode" checkbox on chrome://extensions. Firefox sadly doesn't support this - they'll remove any sideloaded extensions on browser close.

[ Parent | on HN ]
Re:Bitwarden introduces mandatory 2FA for new devices by Macha on Tuesday January 28, 2025 @12:04PM (#42854751)
Yeah, the problem is with clients from January or newer, and vaultwarden versions from before October.

It did lead me to discover my automatic update process wasn't actually rebooting the vaultwarden server.

[ Parent | on HN ]
Re:Bitwarden introduces mandatory 2FA for new devices by infogulch on Tuesday January 28, 2025 @11:46AM (#42854498)
You can enable the new extension UI when you're using vaultwarden by setting the EXPERIMENTAL_CLIENT_FEATURE_FLAGS=extension-refresh env var. I wrote more about it here: https://forum.cloudron.io/topic/13001/bitwarden-extension-ui...
[ Parent | on HN ]
Re:Bitwarden introduces mandatory 2FA for new devices by erdii on Tuesday January 28, 2025 @11:36AM (#42854334)
Be careful about using newer clients with an outdated version of the vaultwarden server.

I lost a couple days of new accounts/passwords because this[1] probably happened.

[1] https://github.com/dani-garcia/vaultwarden/discussions/4921

[ Parent | on HN ]
Re:Bitwarden introduces mandatory 2FA for new devices by sofixa on Tuesday January 28, 2025 @01:43PM (#42856188)
> something I would have rather not thought about

I mean, you're explicitly choosing to self-host an alternative backend server which isn't affiliated with Bitwarden. You could have used their SaaS, or self-hosted their official backend they provide on GitHub, for free, and which is almost entirely open source (AGPL, they have some small enterprise specific bits such as SSO which are under a commercial license which is still free, just not open source).

But you choose to self-host a random person's project that tries to keep track with Bitwarden APIs and various frontends, on a best effort basis. That's a ton of risk I really wouldn't take with something as sensitive as passwords to everything.

[ Parent | on HN ]
Re:Bitwarden introduces mandatory 2FA for new devices by gunalx on Tuesday January 28, 2025 @03:08PM (#42857303)
Its pretty ok as the offical client caches most stuff, everything is still encrypted, and most of all vaultvarden is miles easier to self host than the offical bitwarden stuff.
[ Parent | on HN ]