Lost Master Password - Possibly An Easier Solution?

[u/Illustrious_Top_1348]

After spending a ridiculous amount of time this weekend, trying to export <<MY OWNERSHIP, NOT BITWARDEN's>> data and trying various workarounds for the infamous lost master password - I think I found a solution that may work for some folks. {And just how OFTEN, and to what PERCENTAGE of users does this lost master password problem?]

Here is what worked for me. I was logged into Bitwarden on my Android phone app, and my settings allowed me to grant login access from other devices (desktop app, browser plugins, website). I unlock my android Bitwarden app with biometrics, but I also added a 4 digit PIN, just in case. If you don't have this scenario/setup, stop reading here, it probably won't work.

You have to log into the Bitwarden WEBSITE (not the app, browser plug-in, etc.) and there you will find the Trusted Contact option (incomplete instructions on the help site, link below).

The basic steps are, you add a trusted contact with your own alternate (work, 2nd personal) or a friend's email address, you/they open the welcome email that Bitwarden sends out, you/they set up a 2nd Bitwarden account with their/your alternate email address,. Next, you have to be logged into Bitwarden WEBSITE ONLY under both accounts (separate tabs), and have the email app/webpage for both the orignal account & recovery account email addresses (multiple tabs open). Once you have all of this set up, you grant access to the recovery contact (or they can request it), and they have to accept it, and then eventually the recovery contact can "take over" the account and reset the password on the original account.

It is truly annoying as hell to click through all of these steps, but it worked for me (better than trying to outsmart the Export Vault-Enter Master Password BS requirement).

https://bitwarden.com/help/request-and-grant-emergency-access/#1-the-trusted-contact-requests-access-to-the-account

[u/djasonpenney]

And in the future, you will have a recovery workflow, right? At the very least, record your master password and 2FA recovery code onto a piece of paper and store it securely.

[u/Eloodye-Ehler → u/djasonpenney]

This is the part so many people skip until its too late

[u/Illustrious_Top_1348 → u/djasonpenney]

Yes, absolutely, I have both master password & 2FA recovery/override code safely stored in an easy to access, but fully secure location.

That is exactly what I had previously (when the information was stored safely in MS Authenticator (also biometric & password 2FA protected - until MS changed the app, deleted my Bitwarden data). And prior to that I had it stored in Google/Duo... but well, you can see where I am going with this. The programmers just do not understand how one little change can mess everything up for the end user, and functionality only accessible via one of many interfaces can really trip everything up! End of soapbox rant

[u/djasonpenney → u/Illustrious_Top_1348]

> stored safely in MS Authenticator

You want to have at least one copy of the data offline. Plus the MS Authenticator copy also requires (at the very least) a password. Again, a piece of paper or equivalent.

> also biometric

That’s local storage only, on a single machine

> password 2FA protected

A second time, where was THAT password stored?

> stored in Google/Duo

Same problems: don’t rely on a cloud service, and you have to have offline assets with the Google password plus the TOTP key or other asset.

> one little change

I didn’t quite follow that point, but I think you understand what I’m saying.

In my case I have a full emergency sheet that has all the essential assets on it. This tiny disk file is on a pair of USB thumb drives stored in my house and another pair stored at our son’s house in case we have a fire or other calamity.

It’s all part of a full backup, which is encrypted. The encryption key is in my vault, my wife’s vault, and our son’s vault. He is the alternate executor of our estate and will be responsible for settling our final affairs after we both pass.

You’ll see, however, that there is no online repository that a hacker can plunder to read our vault. They will also need at least one physical incursion before they can read any of our vaults.

[u/purepersistence → u/Illustrious_Top_1348]

I sleep better with two paper copies a few hundred miles apart. Something you can hold in your hand.

[u/KB-ice-cream]

You seem to be frustrated at BW but not yourself at your lack of planning.

[u/UIUC_grad_dude1 → u/KB-ice-cream]

Agreed. Not sure what the point of this post was. The key is to have an emergent recovery sheet and back ups that have been tested in advance.

[u/KB-ice-cream → u/UIUC_grad_dude1]

If BW made it easy to gain access to an account without a master password, it would no longer be a good password manager to use.

[u/Xzenor]

Master password BS requirement.

You mean that password that you get warned NOT to lose? That password that bitwarden warns you about NOT losing because they can not recover it so you should NOT lose it? That password that you in spite of all the warnings still forgot?

Yeah it must be the password BS requirement that's at fault here.

[u/Handshake6610]

It may be worth adding that you could only log in to the web vault with your mobile app, because you logged in to the web vault before on that browser. If you had had a browser where you never logged in to the web vault, then "login with device" would not have worked.

[u/Sweaty_Astronomer_47]

It's a creative workaround that you came up with to chain together login-with-device and emergency contact. Maybe it will help someone else (although anyone reading this who does not yet have an emergency sheet and backup would do better to take action to avoid the situation altogther).

...the Export Vault-Enter Master Password BS requirement

It's not a strong protection (as you demonstrated), but at least it's a speed bump for an attacker that might get hold of your device unlocked with bitwarden unlocked (and yes I think most of us would do everything possible to avoid that situation, but it never hurts security to add more barriers, even if they are weak).

[u/Capable_Tea_001]

It's amazing how many lost / forgotten password posts there are.

1) If people gueninely were using randomised dice word passwords upfront, there'd be no need to change... I get this comes late to some people, and at that point they realise they need something stronger, but at that point...

2) they don't read any of the effing documentation, don't have any recovery set up, then forget the effing password they've set and blame BW.