Earlier this month, I wrote a tutorial on enabling the upcoming security standard
WebAuthn in Bitwarden as a two-step login protection. WebAuthn, which stands for Web Authentication, is integrated into operating systems, browsers and other programs.
One of the shortcomings of the standard is, that it is not available universally at the time. Bitwarden users who set the authentication feature up on a device may notice that they lock themselves out on other devices.
This may happen under two circumstances:
- The "other" device or software does not support WebAuthn yet.
- Operating system specific authentication options, such as a Windows Hello Pin, were selected for authentication.
When I set up WebAuthn in Bitwarden on my work laptop, I configured it to use the Windows Hello Pin. The other option, using a security key, was not selected at the time. Attempts to sign-in to Bitwarden on other devices, even other Windows devices, were met with a prompt to enter a security key for authentication. The Windows Hello Pin is valid only on the device it is set up on.
Once WebAuthn is set up, Bitwarden users may run into this issue. The only way to resolve this is to add a second two-factor authentication option to the account, which may then be used on other devices. Bitwarden users who have access to a security key, e.g. a Yubikey, may use that method as well, but it may still lead to issues on devices that do not support WebAuthn.
