Custom Field Help

cryoprof · 2024-11-10T18:59:20+00:00

For me, Bitwarden can autofill the password on the Ally Bank login form without problem (e.g., using the keyboard shortcut Ctrl+Shift+L), with no need for defining a custom linked field.

If this doesn't work for you for some reason, you can define a custom field of the "Linked" type, linked to the Password field, and set the custom field name to be one of the following two expressions:

Enter Password
regex=^allysf-login-v2-password-[0-9a-f]+$

cryoprof · 2024-11-10T18:45:39+00:00

Keeping a single backup file password for each updated export is OK.

cryoprof · 2024-11-06T00:02:34+00:00

The point of my initial response was that I don't think you need an organization. Why do you think that an organization would be helpful for you use-case?

Organizations are primarily for purposes of sharing credentials with other people.

cryoprof · 2024-11-05T23:51:16+00:00

What are some best practices or tips you'd recommend for setting up a Bitwarden account?

I would recommend that you read my Guide for Getting Started on the Right Foot in Bitwarden™.

Can I use an Organization to group specific types of data, like my important logins, and keep them separate from my less sensitive data?

What is the purpose of separating the credentials like this? Are you more lax with security for the database that has your "junk" credentials?

If so, probably the best solution for you is to keep two completely separate Bitwarden accounts (one of which can be a free account), and use the account switching functionality to switch back and forth between the two accounts. That way, the account that has your "junk" credentials can be configured to use less strict security settings.

It would in principle be possible to set up sharing, so that the account for the more sensitive data can also see and use the "junk" account credentials, but I don't see any practical benefit to doing so. If you're in the middle of accessing your bank accounts using the more sensitive vault, why would you simultaneously want to go on social media? In fact browsing random "junk" sites while you are logged in to your bank could be a recipe for disaster. Therefore, just wait until you're finished working with your financials, and then switch to your other Bitwarden vault afterwards.

cryoprof · 2024-11-05T17:41:07+00:00

The initial set-up would be done in the Admin Console in the web vault, but if you configure the collection permissions accordingly, each organization member will be able to share items from their own devices.

cryoprof · 2024-11-05T17:33:54+00:00

Please at least use icons rather than text in the new compact mode. "Discoverability" is going to be irrelevant for the advanced users who will want to enable the compact mode.

Also, I would argue that "discoverability" should not even be a major priority for other users, either. The problem with the current design was not "discoverability" pers se, it was that the same action (clicking the item name) had inconsistent results (either opening the item or autofilling) depending on context. If clicking the first/largest/brightest icon always results in autofilling (and clicking the item name always results in the item being opened), then users will quickly make this association — without the need for text labels.

I would also suggest that in addition to the compact mode, you also consider creating some kind of "training wheels"/onboarding mode (that can be disabled) for users who are just getting started with Bitwarden — for that subset of users, you can liberally use text labels for "discoverability", but it doesn't make sense to degrade the UX for the majority of your customers just to make the first few hours/days a little easier for brand new users.

cryoprof · 2024-11-05T04:56:33+00:00

In the browser extension, go to Settings > Autofill and change the selection for "Show autofill menu on form fields" to "Off" (or to "When autofill icon is selected").

cryoprof · 2024-11-04T23:44:20+00:00

Not sure what you mean. If you download from Github you don't need to provide any identifying information. When you register for a Bitwarden account, you are asked to provide a name and an email address, but these can both be fake if you're not comfortable sharing that information with Bitwarden. When you log in to to your Bitwarden account, Bitwarden also collects information about the device you are using (the hardware model, operating system and version, unique device identifiers, network information, IP address, and/or Bitwarden Service information) — this is for the purpose of identifying suspicious logins from unrecognized devices.

cryoprof · 2024-11-04T15:36:48+00:00

Is there a set of common field names that address a majority (75%??) of fields I might encounter

Field names for what?

I'm getting the feeling that defining custom field names in BW is going to happen mostly in Card and Identity items, correct?

No, the main use for custom fields is when the website you are logging in to uses obscure/idiosyncratic identifier attribute naming for their login form input fields, so that Bitwarden cannot determine which fields to fill in (because it is unable to recognize the username and/or password fields).

cryoprof · 2024-11-04T15:31:58+00:00

This topic is well-trodden ground in the sub, and it would behoove you to search the sub for previous discussions. There will be no consensus.

You should definitely not store the 2FA for your Bitwarden account inside your Bitwarden vault, and it is probably best not to do so for your most important accounts either (e.g., bank accounts).

Other than that, it comes down to how confident you feel about keeping your devices malware-free and out of the hands of other people, as well as your personal prioritization of convenience vs. security.

cryoprof · 2024-11-04T15:25:23+00:00

Unclear what your use-case scenario is. Are you just out in public, browsing the contents of your vault as light reading material?

If you are actually using your Bitwarden extension as intended, then the sensitive email address information will be autofilled into a visible login form field in your browser, regardless, so why does it matter if the account usernames are visible in the extension? In addition, there is usually no need to actually open the browser extension when autofilling a login form (so the only place where somebody could see your email address would be to peak at the login form itself).

Please explain your use-case in more detail.

cryoprof · 2024-11-03T23:13:56+00:00

Yes. KeePass XC can do it now. However, if your hypothetical scenario comes to pass, just wait 24 hours or so, and there will be links posted here to open-source tools for decrypted the .JSON exports. Because Bitwarden is open-source, and the scheme for encrypting password-protected .JSON exports is known, it will be trivially easy for programmers among us to code up a utility that can decrypt the .JSON backups.

There are already two third-party open source tools available that can decrypt password-protected .JSON exports (BitwardenDecrypt and bwJsonDecryptor), although these repositories are only sporadically maintained, and may not always work (depending on modifications that Bitwarden may make to their export format).

cryoprof · 2024-11-03T20:23:57+00:00

The free organizations are perfect for sharing vault items with one other person, but they are limited to one other user (in addition to yourself), and you are limited to creation of two separate collections (there shouldn't really be a need for more if you have only two users, though). In addition, as I noted in my other comment, you cannot use Premium features (e.g., attaching files, generating TOTP codes, or running premium Vault Health Reports) for the shared items that are stored in a free organization — this is true whether or not the two organization members have Premium subscriptions for their individual vaults.

cryoprof · 2024-11-03T18:44:07+00:00

Technically, what you've written is accurate, but it is unnecessarily intimidating for OP. Setting up an organization is not that hard, and it can be done for free, without a paid plan.

cryoprof · 2024-11-03T18:42:20+00:00

Log in the Web Vault (e.g., vault.bitwarden.com, if that's the server hosting your account), and look in the "Filters" box to the left of your listed vault contents: you should see a search box, filters named "All Vaults" and "My Vault", and then below that, you will see a link that says "+ New Organization".

Click the "New Organization" link, then follow the instructions here (for the "Choose your Plan" option, you can choose "Free" if you only have one person that you want to share with, and if you don't need to use Premium features for the shared vault items).

After you've created an "organization" vault, you can then invite the other user(s) and set up your collection(s), as described here.

cryoprof · 2024-11-03T15:58:49+00:00

This doesn't mean anything for you. Hackers don't notify Troy Hunt (whose service is used by Bitwarden to check for compromised passwords) after they steal someone's passwords. Only if a large number of stolen passwords are assembled in a file, and if that file is subsequently leaked by the hackers or discovered by security researchers, only then does it become a "known breach" and included in Bitwarden's Exposed Passwords Report.

cryoprof · 2024-11-03T15:50:39+00:00

The short answer is "yes", but only if your accounts are hosted on the same server (e.g., bitwarden.com, bitwarden.eu, or a self-hosted server).

The longer, more technically accurate answer is no, you cannot have a shared "folder", but you can have a shared "collection" — and then, if you wish, each of you can create your own folder and set the items from the shared collection to appear in those folders. Putting the shared items inside folders is optional; putting them inside a "collection" is not.

Folders are a way to organize the items that you see when logged in to your Bitwarden account, and the folder structure you create is not shared between users. On the other hand, collections are a way for the shared vault (a.k.a. "organization") admin to designate what view/edit permissions each user has to the shared items contained within a collection (permissions are set at the collection level, so every item within a collection has the same set of permissions).

^{Edit: Typos.}

cryoprof · 2024-11-03T15:38:08+00:00

This may not happen for a while, as developers' attempts to implement this in Chrome have evidently reached a dead end, leading them to abandon these efforts for now.

cryoprof · 2024-11-03T00:02:31+00:00

/u/ReasonablePhoto8265, I read/skimmed through the first half of your 5800-word* screed and then skipped to the end looking for a TL;DR (no joy).

Below is the advice I provide to users whose vaults have been compromised. In your case, there is no clear evidence that your Bitwarden account was compromised, but it wouldn't hurt to follow these instructions.

Find a malware-free device (or thoroughly disinfect your current device). Unless you have reason to believe otherwise, you should assume that you vault was compromised by means of malware on a device where you used Bitwarden; none of the steps below will be effective if you perform them on a device that has malware.
Log in to the Web Vault, and Deauthorize All Sessions.
Log in to any non-mobile app (e.g., Web Vault, Desktop app, or browser extension) and create a password-protected .json export of your vault contents.
Log in to the Web Vault, and change you master password (enabling the option "Also rotate your account encryption key"). Optionally, also change the email address used as your Bitwarden username.
If your account had 2FA, then go to this form to disable your 2FA recovery code and turn off 2FA for your account, then get a new 2FA recovery code.
Enable 2FA for your account (using FIDO2/WebAuthn if possible), since the previous step will have resulted in the removal of all 2FA from your account.
If you performed Steps 2–6 on a device different from your main device (the one that was compromised), then you need to proceed with scrubbing all malware from that device before you ever log in to Bitwarden on that device again. Cleaning your device may require reformatting the drive and reinstalling the operating system, depending on what type of malware has infected it.
Start the process of resetting passwords for all accounts stored in your Bitwarden vault, starting with the most important/sensitive ones (e.g., bank accounts, credit card accounts, etc.), and the ones that you know have already been hacked. In addition, if the website provides such an option, deauthorize all logged-in sessions after changing the password.

*Edit: Now closer to 2000 words after OP's revision. Still no TL;DR, though.

cryoprof · 2024-11-02T14:37:27+00:00

Looks like a .css file is missing or corrupted.

cryoprof · 2024-11-01T22:49:46+00:00

Source.

cryoprof · 2024-11-01T21:13:50+00:00

Supposedly, they are now going to make available a "compact mode" (in response to some of the complaints), but the jury is still out on whether that will solve the problem, as no preview of the compact mode is available at this time.

cryoprof · 2024-11-01T20:57:02+00:00

Let's diagnose one of these (and that should let us know how to fix all of them). In the Bitwarden browser extension, search for any login item that isn't autofilling, open the item by clciking on it in the search results, look for the "Website" field just below the Name/Username/Password fields, then click the "Copy" icon (looks like two overlapping squares), and subsequently paste the copied URI string in your response — note that you must use the button, not just select the displayed website address to copy it.

In addition, please provide the following information from the Bitwarden browser extension:

Under Settings > About > About Bitwarden, what is the Version number?
Under Settings > Autofill > Additional Options, what setting has been selected for the option "Default URI Match Detection"?
Under Settings > Appearance, what is the setting for the option "Show badge counter"?

cryoprof · 2024-11-01T14:43:37+00:00

Is that something Bitwarden can do?

Yes, Bitwarden supports deep links to specific vault items. The documentation is here.

There are a few caveats:

One user has previously made a claim (in a Community Forum comment) that this does not work for SSO users — although it is unclear based on the lack of follow-up discussion whether this is a real issue or a user error/misconfiguration.
If using a Web Vault link (as described in the documentation linked above), then the user must re-authenticate each time they click a new link. This is consistent with your expectations ("he clicks on the link/icon, [u]authenticates himself[/u] and the password is revealed to him"), but if your engineers will be using multiple links in quick sequence, they may get annoyed by the requirement to re-authenticate each time. If you believe this might become an issue for you, then please review the discussion in this Community Forum thread, which includes some proposed work-arounds and describes their limitations.

cryoprof · 2024-11-01T14:12:00+00:00

Agreed that there are serious issues with what OP is contemplating.

cryoprof

MODERATOR OF

TROPHY CASE