Advice Request Bitwarden - Newbie needs help

[M4RT1NE2]

Bitwarden seems to be a good password manager. But is there an option in it to store your database locally on disk not in the cloud.

 

[Stopspying]

Is that setting for all sites, or possible to set per site?

"Auto-fill on page load is an experimental and opt-in feature offered by Bitwarden browser extensions. Auto-fill on page load will auto-fill login information when a web page corresponding to a login's URI value loads. Once enabled, you can set the default behavior (on for all items or off for items).
To enable this feature, navigate to Settings → Options in your browser extension, select the Auto-fill on page load option, and choose your default behavior. Once enabled and the default behavior is set, you can additionally specify auto-fill on page load behavior for each individual login:

Using this convention, you can setup your browser extension to, for example:

• Auto-fill on page load for only a select few items (off by default for all items and manually turned on for select items).
• Auto-fill on page for all but a select few items (on by default for all items and manually turned off for select items).

Warning​

This feature is marked experimental and is disabled by default because, while generally safe, attackers with fake websites could take advantage of this to steal credentials."

Autofill Logins in Browser Extensions | Bitwarden Help Center

Learn how to autofill logins stored in the Bitwarden password manager from a browser extension.

bitwarden.com

 

[Stopspying]

Bitwarden seems to be a good password manager. But is there an option in it to store your database locally on disk not in the cloud.

"On your local machine​

Data that is stored on your computer/device is encrypted and only decrypted when you unlock your vault. Decrypted data is stored in memory only and is never written to persistent storage. Encrypted data is stored in the following locations at rest:

Desktop app​

• Windows
  • Standard installation: %AppData%\Bitwarden
  • Microsoft Store installation: %LocalAppData%\Packages\8bitSolutionsLLC.bitwardendesktop_h4e712dmw3xyy\LocalCache\Roaming\Bitwarden
  • Portable: .\bitwarden-appdata
• macOS
  • Standard installations: ~/Library/Application Support/Bitwarden
  • Mac App Store: ~/Library/Containers/com.bitwarden.desktop/Data/Library/Application Support/Bitwarden
• Linux
  • Standard installations: ~/.config/Bitwarden
  • Snap: ~/snap/bitwarden/current/.config/Bitwarden""

Storage | Bitwarden Help Center

This article describes how Vault data is encrypted and hashed on local devices before being sent to the Cloud for secure storage.

bitwarden.com

 

[HarborFront]

"Auto-fill on page load is an experimental and opt-in feature offered by Bitwarden browser extensions. Auto-fill on page load will auto-fill login information when a web page corresponding to a login's URI value loads. Once enabled, you can set the default behavior (on for all items or off for items).
To enable this feature, navigate to Settings → Options in your browser extension, select the Auto-fill on page load option, and choose your default behavior. Once enabled and the default behavior is set, you can additionally specify auto-fill on page load behavior for each individual login:

Using this convention, you can setup your browser extension to, for example:

• Auto-fill on page load for only a select few items (off by default for all items and manually turned on for select items).
• Auto-fill on page for all but a select few items (on by default for all items and manually turned off for select items).

Warning​

This feature is marked experimental and is disabled by default because, while generally safe, attackers with fake websites could take advantage of this to steal credentials."

Autofill Logins in Browser Extensions | Bitwarden Help Center

Learn how to autofill logins stored in the Bitwarden password manager from a browser extension.

bitwarden.com

Yup, tried it. But it's a hit-or-miss thing. Tried many times opening websites, and it sometimes works, say more of a miss thing

 

[HarborFront]

Instead of using a password made up of a long string of unmemorable alpha-numeric charecters try using a passphrase such as "MalwareTipsisFullofGeeks", how could you forget that?!!

Opinions can vary on the comparative ease of cracking PINs and passwords, the old adage was that the longer it is the better.

Your passphrase uses only alphabets. I just thought of a passphrase which uses alphabets, numbers and special characters like

1+1Not=TwO

You can create a longer passphrase using the above approach or similar

 

[Stopspying]

Your passphrase uses only alphabets. I just thought of a passphrase which uses alphabets, numbers and special characters like

1+1Not=TwO

You can create a longer passphrase using the above approach or similar

Sure, I just used it as an example.

 

[Stopspying]

Yup, tried it. But it's a hit-or-miss thing. Tried many times opening websites, and it sometimes works, say more of a miss thing

It says that this feature is experimental so some error/failures should be expected. additionally, its not thought to be a good thing to use the browser extension of password managers.

Are Password Manager Browser Extensions Unsafe? - Best Reviews

Uncover the truth about password manager browser extensions, exploring how they could impact your efforts to stay secure online.

password-managers.bestreviews.net

Stop using password manager browser extensions

Browser-based password manager extensions such as those in LastPass are risky and have the potential to steal your credentials without your knowing.

www.networkworld.com

 

[HarborFront]

It says that this feature is experimental so some error/failures should be expected. additionally, its not thought to be a good thing to use the browser extension of password managers.

Are Password Manager Browser Extensions Unsafe? - Best Reviews

Uncover the truth about password manager browser extensions, exploring how they could impact your efforts to stay secure online.

password-managers.bestreviews.net

Stop using password manager browser extensions

Browser-based password manager extensions such as those in LastPass are risky and have the potential to steal your credentials without your knowing.

www.networkworld.com

From the article you linked. If don't use the PM extension can autofill if just use the PM desktop app?

Actually, like BW, from the extension you can lock the vault and unlock with PIN/biometrics or use 2FA so it's safe to use the PM's extension

 

[HarborFront]

Learning to use BW and KeePassXC. Can someone tells me what happens when you have 2 or more PMs.

Assuming you set to autofill a website like malwaretips.com in both the PMs what would happen when you open malwaretips.com? Which PM takes the precedence in autofilling?

Or it's not a good practice to set the same website for both PMs i.e. to use different PM to open different website

Thanks

 

[HarborFront]

"On your local machine​

Data that is stored on your computer/device is encrypted and only decrypted when you unlock your vault. Decrypted data is stored in memory only and is never written to persistent storage. Encrypted data is stored in the following locations at rest:

Desktop app​

• Windows
  • Standard installation: %AppData%\Bitwarden
  • Microsoft Store installation: %LocalAppData%\Packages\8bitSolutionsLLC.bitwardendesktop_h4e712dmw3xyy\LocalCache\Roaming\Bitwarden
  • Portable: .\bitwarden-appdata
• macOS
  • Standard installations: ~/Library/Application Support/Bitwarden
  • Mac App Store: ~/Library/Containers/com.bitwarden.desktop/Data/Library/Application Support/Bitwarden
• Linux
  • Standard installations: ~/.config/Bitwarden
  • Snap: ~/snap/bitwarden/current/.config/Bitwarden""

Storage | Bitwarden Help Center

This article describes how Vault data is encrypted and hashed on local devices before being sent to the Cloud for secure storage.

bitwarden.com

Can the at rest vault be pointed and moved to, say an external USB flash drive/SSD? This is to prevent malware infection and a dead PC/laptop

If yes, how to do it? Or I need to self-host and store the vault externally?

Thanks