Why YSK: Because if you are like most people, you also store your email’s password in your Bitwarden Vault and not bother remembering it, causing you to potentially get locked out (since you wouldn’t be able to log in to your email to get the verification code, because your email’s password is in the vault itself 👀)
(Imagine leaving your key in your house, lol)
Source: https://bitwarden.com/help/new-device-verification/
Excerpt:
To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login. After entering your Bitwarden master password, you will be prompted to enter a one-time verification code sent to your account email to complete the login process when logging in from a device you have not logged in to previously. For example, if you are logging in to a mobile app or a browser extension that you have used before, you will not receive this prompt.
Good thing I noticed, otherwise I might’ve had a bad time next month 😖
Edit: Updated title to clarify that people who have 2FA are not affected.
Guess its time to set up a hardware key
I’ll probably move to Keepass, I like to have control over my vault file, probably better than whatever “2fa” they are forcing anyways, since only I know where the vault is at.
I mean, if they’re forcing 2FA at all, that’s a good thing, but they still have the usual TOTP and hardware key options.
Anyway, I understand why people would want to host their own vault file. Just remember that obfuscation (i.e. being the only one who knows where your vault is) isn’t a viable security method. Removing access to potential thieves is.
Already store the most critical stuff in keepass; use bitwarden for the lower-risk stuff that benefits from the higher convenience factor.