Like I had to authenticate with my Yubikey before it displays the codes. Go to the menu bar on the left hand side and select Security, then in the top menu bar select Two-step. I might reenable it if they added another level of security before getting the code. How to enable two-step login for your Bitwarden account. But is has me a little concerned about how security minded are the Bitwarden developers? Do they understand this is a risk and did it anyway? Have they implemented something to make it more secure that I am missing?

I already deleted the 2FA tokens from my vault. Is this a known security issue and people just decide to do it anyway for convivence? Or am I missing something and it's more secure than I think? If the worst happens and someone breaks my vault, they have my username, password and 2FA tokens so they can log in with no challenge. It seems to me that having the 2FA tokens saved in Bitwarden right next to the password and username kind of defeats the purpose of having 2FA in the first place. When I switched I got excited and put all my 2FA tokens in Authy on my Phone and in Bitwarden.īut as I was using it the more worried I got.

I switched to Bitwarden last month and I like it.

Bitwarden 2 factor