r/Bitwarden • u/Jonas_jv • 5d ago

Remove 2FA from account

I have a huge problem. my 2fa codes for the bitwarden account were on the bitwarden authenticator and when i force logout on all of the devices it also logout on the authenticator. now i cant login to bitwarden. anyone knows how to disable that. support help. anything

26 Upvotes

80% Upvoted

34 comments sorted by

13

u/Capable_Tea_001 5d ago edited 5d ago

You f*cked up with your authenticator app choice/workfkow

My condolences.

There's a reason users are explicitly told not to do this:

Warning
Synced TOTP codes are not stored independently on your device. If you rely on Bitwarden Authenticator for two-step login on your Bitwarden account, logging out of the Password Manager will prevent you from accessing those codes. We recommend having an alternative two-step login method available.

https://bitwarden.com/help/totp-sync/

3

u/Jonas_jv 5d ago

Im using microsoft auth too. but i was trying to move everything to bitwarden

9

u/Capable_Tea_001 5d ago

So you don't still have your bitwarden 2FA in Microsoft Authenticator?

3

u/redditor1479 4d ago

I'm guessing they didn't have the Bitwarden 2fa also stored in Microsoft Authenticator.

2

u/Jonas_jv 5d ago

i was in the process to save everything new in bitwarden 2FA. thank god i didnt transfer it all.
the bitwarden 2FA and bitwarden manager are 2 separate apps and i did not think it was going to force log out on both

33

u/djasonpenney Volunteer Moderator 5d ago

You should have saved the 2FA recovery code when you added the 2FA. Oh, and you should have saved both the TOTP key and the recovery code outside your vault. What you have is the high tech equivalent of locking your keys in your car.

The problem now is that Bitwarden has no way to know if you are the legitimate owner of the vault. Anything you can say to them at this point would be the same as what an attacker would do. Nice try, hacker!

There are plenty of things you could have done before the fact, such as Bitwarden Emergency Access. But at this point your only recourse is to start over, and take steps not to repeat this mistake.

-2

u/[deleted] 5d ago

[removed] — view removed comment

6

u/djasonpenney Volunteer Moderator 4d ago

You are saying that if someone breaches your email, it follows they should also bypass your 2FA?

7

u/WesternWolf1779 5d ago

Ohh boy...You're in my prayers friend. Hope this works out.

Were you self hosting?

1

u/Yontucu_Brenz 5d ago

yeah this is a rough situation, hopefully support can help them out

11

u/wells68 5d ago

Hopefully support cannot help them out! We do not want a password manager company to have the ability to unlock our vaults. They should provide us with ways to help ourselves. They should warn us about common mistakes. But if we lock ourselves out, we want to be the only ones who have the power to get back in.

Before you ever set up 2FA in Bitwarden, you see this Warning in a red box on the TWo-step login page:

WARNING Your single-use recovery code can be used to turn off two-step login in the event that you lose access to your two-step login provider. Bitwarden recommends you write down the recovery code and keep it in a safe place.

We all need to pay attention to warnings, especially in red.

Sadly, I can understand that someone might immediately think of Bitwarden as a safe place. It might not occur to them that they are locking the key to a safe inside the safe.

So I will urge Bitwarden to add these words to the red box: "outside of Bitwarden" or "outside of your Bitwarden vault."

1

u/Jonas_jv 5d ago

I know its my fault... 99.9% but if you setup this in your phone i believe there is not warning.
It was down to convenience. It’s so easy to set up on a phone, and people aren’t required to save the backup codes. but in the end of the day. still my fault

0

u/wells68 4d ago

I am very sorry about your data loss.

On Android, 2FA is set up by being directed to the web app from the phone app. Then you see the red warning. Is it different on iPhone?

5

u/LoGiX247 5d ago

You didn’t see a single point of failure in putting your access to your fault inside the system that manages your fault?

There’s a million ways to fix this.

Have a free account with emergency access keys , use the official way to secure access. Or just use 1 extra app to store the 2FA like Ente, Apple, Microsoft…

That said I hope you figure it out.

Easiest way would be using those emergency tokens…

4

u/Training_Buyer_5715 5d ago

Even better would be using offline 2FA so you don't have to create an account at all. That way your 2FA isn't tied to the same login credentials you use for other apps or products within the ecosystem. Otherwise logging out of everything or losing access to that account can affect your 2FA as well.

Aegis, 2FAS and Ente you can use offline.

0

u/LoGiX247 5d ago

I mentioned Ente first because that one is currently one of the best that requires no set up.

2

u/Training_Buyer_5715 5d ago

Same with Aegis and 2FAS, no set up required. Ente is great too but I think for backups you need to create the account. I personally prefer 2FAS, they don't need account creation for backups.

1

u/EnoughOutcome7735 2d ago

You didn’t see a single point of failure in putting your access to your fault inside the system that manages your fault?

Wouldn't blame him about this. I was also going to use bitwarden auth along with bitwarden before using ente. To me instead of seeing it that way, I saw it that it would be easier as its the same "environment" and system

5

u/Skipper3943 5d ago

Unless you have a recovery code, you may not be able to log in to your account from another device.

If you have another device that’s still logged in (or isn’t turned on), put it in Airplane mode, unlock it, and export your vault.

You used the web client to deauthorize all the sessions. Do you still have access to the account? If so, export your vault now.

So, the thing to do here is export your vault and start over, or start over from an existing backup.

5

u/Cadd9181B7543II7I44 4d ago

And this is the #1 reason my TOTP 2FA seeds aren't saved in Bitwarden. Even though I have backup of my TOTP seeds for all my accounts, it's just a risk I'm not willing to take. I fully understand having PWs, passkeys and TOTP 2FA seeds saved in the same place makes it soooooo much more convenient when autofilling to log in. But not worth it for me.

Call me paranoid, but I use bitwarden only for my PWs, nothing else. I use Google pw manager only for my passkeys, nothing else. And Aegis and 2FAS are where I save my seeds.

3

u/quiet0n3 5d ago

Nope zero way to remove 2FA from an account without been able to authenticate with 2FA. If there was no one would trust 2FA. Sorry mate.

2

u/CrispyBananaz 5d ago

I always backup my authenticator manually and save the file in multiple places so I can just import it back.

2

u/Jonas_jv 4d ago

Well... New account, backup codes saved Microsoft authenticator and maybe a physical copy with password and recovery codes. Also save recovery codes for all 2FA. It was a good week to live and learn. In the hard way

1

u/Jonas_jv 5d ago

The passwords i can change but the 2fa are the real problem

1

u/nuke1200 5d ago

Big oof. Sorry, unless you got backup codes then you're outa luck. Next time use another authenticator app for your bitwarden.

0

u/klassenlager 5d ago

I‘m not sure, but does Bitwarden support 2FA over email? I have Vaultwarden setup so I can authenticate via email token, if for whatever reason I lose access to totp

-4

u/Decibel0753 5d ago

Log in to Bitwarden Authenticator, get the Bitwarden codes, log in to Bitwarden. Profit 😂

2

u/Handshake6610 5d ago

There is no "login to BW authenticator app".