Also, I’m not sure if anyone else get any notice, but in my experience I didn’t even get a notice in my email at all. I just went to the browser page moments ago and saw the notice. I was like “WTF”. I logged in a few days ago on the 22nd and didn’t see that, so this must be recent. Less than 10 days of notice? Wtf Bitwarden?!?

(I don’t currently use 2fa because I have trouble with misplacing 2fa stuff, so I’m more likely to get myself locked out with 2fa, than having someone hack my vault without 2fa.)

something done by many services, sites, and games.

but yea, i get it. the problem of asking someone to login to a service that they (bw) are holding your key for, in order for you to get into where that key is held.

This is a good thing. Any account you care about and don’t want to be accessed by anyone without your consent should have multifactor authentication enabled. Use an app like Google Authenticator or a hardware token like a Yubikey. 2FA through text or email is insecure and easily bypassed.

Friends don’t let friends raw dog the internet. Don’t be dumb and get your shit stolen. Use MFA everywhere.

My email is one of the few passwords I still know without my password manager.

It probably is time for me to rethink that 🤔

Thanks for the heads up, though this would be less of an issue if you have the email app on your phone or the tab pinned in Firefox.

The real issue is i gotta use another authentication app for my email now, have been using Bitwarden itself for 2fa codes for proton. Definitely can’t use proton pass to 2fa for my proton account.

I don’t even know. Gonna have to find another reputable authenticator app.

Guess I should also check if Bitwarden or proton support physical security keys. Would be pretty bomb proof since my keys are always in my pocket anyway.

For what it’s worth, as of a minute ago the form that’s for sending the email code asks if you have reliable access to the email before sending the code.

But otherwise seems to be a non-issue with any of the software/hardware mfa options it supports. Good to let others know about this though!

To be fair your post title does not match their own text

To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login.

So it’s not all accounts, just the ones that don’t already have 2FA. Personally I wouldn’t have noticed any changes since I already use 2FA enabled with an authenticator app. But I can see how this might bite you in the ass if you weren’t already using 2FA.

Interestingly I used to run into a similar issue when using Lastpass. When logging in from other IP addresses they would often do mandatory email 2FA, and of course I couldn’t get into the email account without Lastpass. But it sort of resolved itself since I also have email on my phone so I just had to make sure those Lastpass emails didn’t end up in spam or wherever.

Why would they ever force this?

The purpose of MFA is to:

Mitigate using the same password on multiple sites and one of them has a data breach.

Mitigate the impact of keyloggers/other kinds of malware.

Mitigate the bad security of bad passwords.

Mitigate the password manager’s own data breach.

If you have at least two braincells, you will chose a unique and secure password for your password manager. That’s the point of password managers, that you only have to remember 1 password so it can be unique and strong. Also, a password manager (specially open source) should have almost perfect security, so them being hacked should not be a concern.

The only thing MFA is doing on password managers is to mitigate malware. Which I don’t think is a good justification to force everyone the hassle of MFA.

Fine if the wanna give the option of MFA, but don’t force it on everyone.

@OP There will be an option to turn it off, maybe add that to the post

An option to turn off new device login protection will be available in the web vault account settings

This is not the end of the world, some mighty overreaction on the comments. This is why diversity is the answer to security. Multi factor, multi mode, multi device. Something you know, something you have, something you are, etc.

If you have more than one device, like PCs, laptop, phone, in any combination, and you have your access config on all. Then there’s an infinitesimally small chance you’d lose access to your vault.

I hate this so much. My Bitwarden password is the one thing I know. I’m not confident I could ever learn another password, especially one I barely ever need.

And 2FA? What if my phone breaks? My 2FA recovery codes are in Bitwarden.

Ugh. I have no idea what I’m going to do.