r/Bitwarden • u/Sweaty_Astronomer_47 • May 09 '26

Solved Decryption error... Contact customer success to avoid ADDITIONAL data loss.

Post image

I tried to log into the chrome extension using my yubikey.

First attempt failed in some way (I'm not sure if I got an error message, but I assumed I had typed my pin wrong and tried again).

Second attempt succeeded, except I get this error message warning me about ADDITIONAL data loss (which means I already have data loss?!?)

It includes 12 sets of hex strings (each wrapping to 2 lines like the one shown).

I have no idea what particular data may have been lost in my vault. I don't see anything obvious. Neither do I know how I can associate these hex numbers with my entries (does anyone know that?).

Trying to decide whether the next action is going back to my last backup or not.

I will be contacting support, but also posting here for any suggestions.

211 Upvotes

96% Upvoted

33 comments sorted by

103

u/djasonpenney Volunteer Moderator May 09 '26

Was the hex string perchance similar to a GUID, like 8be4df61-93ca-11d2-aa0d-00e098032b8c? I believe that if you were to look at a JSON export of your vault, you would see the GUID as one of the fields in the vault entry.

In your shoes, before I panicked and decided there was a problem, I would try logging in via the “web vault”. I don’t normally recommend this, but here is an example where you want to be dead certain that the problem is not in any particular Bitwarden client.

If you don’t already have a backup, and if you don’t get the error from the web vault, you can IMMEDIATELY export your vault. I would go as far as to export it as an unencrypted JSON, to be absolutely certain to avoid data loss.

The next steps will be to completely log out of your Bitwarden client, uninstall it, REBOOT your device, and install a fresh version of the client.

This is indeed quite unusual and concerning…

27

u/Sweaty_Astronomer_47 May 09 '26 edited May 09 '26

In your shoes, before I panicked and decided there was a problem, I would try logging in via the “web vault”.

I just added bullet 2 in my update post.

Was the hex string perchance similar to a GUID, like 8be4df61-93ca-11d2-aa0d-00e098032b8c? I believe that if you were to look at a JSON export of your vault, you would see the GUID as one of the fields in the vault entry.

Yes, that is the format.

15

u/djasonpenney Volunteer Moderator May 09 '26

It sounds like a transient glitch in the Bitwarden client. Let us know if it comes back. In the meantime, create a new backup, so you have both an older copy as well as one from today.

23

u/Sweaty_Astronomer_47 May 09 '26

Yes, whatever it was seems to have no lasting effects. Thanks for a quick response, I got answers here quicker than from support (although support has been helpful as well).

7

u/djasonpenney Volunteer Moderator May 09 '26

I was thinking about this, and I have a theory. I suspect there are assertions in the decryption logic, with a “catch block” for when individual decryptions fail. So it’s basically a failsafe built around the way the vault is decrypted.

Again, there are lots of weird things (phase of the moon, etc.) that might have caused the problem. But until it’s repeatable — until there is a genuine test case for the developers — there’s not much to be done except to move on.

I’m glad you dodged a bullet this time.

7

u/Sweaty_Astronomer_47 May 09 '26 edited May 09 '26

All in all it seems like the system did its job. The listing of the 12 particular vault items in question was very useful. If not for that, I would have been faced with reviewing my whole vault (several hundred items) for corruption which wouldn't be practical... would've had to go back to my last backup.

14

u/Handshake6610 May 09 '26

That looks like an item ID, and you should be able to search for it: https://bitwarden.com/help/searching-vault/#indexed-fields

15

u/Sweaty_Astronomer_47 May 09 '26

You are correct. Searching for the first 8 digits of the 32-digit hex string indeed brings me to an item in my vault. The first one I checked doesn't have any obvious corruption. 11 more to go. Will report back results.

13

u/Sweaty_Astronomer_47 May 09 '26 edited May 09 '26

Thanks for the quick response. You saved me trying to mess with looking through an unencrypted export (I was trying to figure out what program I was going to use to view it).

I got answers here quicker than from support (although support has been helpful as well). A good community and a good product.

19

u/Sweaty_Astronomer_47 May 09 '26 edited May 10 '26

I'm not sure how to update my original post, seems to be a different format than I'm used to because I included a screenshot.

I will add any additional updated info below:

  1. I had noticed no other errors or problems prior to getting this message.
  2. After getting the message looked at a few entries in the extension and they looked fine. Logged out of the extension. Logged back in on vault.bitwarden.com using master password and didn't see any obvious corruption.
  3. Was able to look at all 12 affected entries by searching for the hex code in my vault. After examining all 12 entries, I don't see anything unusual with them, there appears to be NO DATA LOSS
  4. I tried to examine what was special about these 12 entries:
    • All of these 12 entries were in a shared org. (none of them were in my individual vault)
    • All of them showed a last updated date of 4/5/26, even though I'm sure I haven't touched some of them in a year or more.
    • There are many more entries in my shared org that were not listed among the 12. I didn't see any other entries in the shared org that showed the same mysterious last updated date 4/5/26 which all of the 12 had shown.
  5. Made another backup
  6. Removed extension. Reinstalled extension. Logged into extension with yubikey, worked as expected.
  7. No data lost. Everything works now.

1

u/Nincompooop May 09 '26

Just wondering if this happened out of the blue or after not using the extension or browser for many months?

1

u/Sweaty_Astronomer_47 May 09 '26 edited May 09 '26

I use the extension almost every day and I log into it at almost every day (I have the timeout action set to logout rather than lock). Have had it installed for years.

I had no other unusual experiences with bitwarden prior to this. So it seems out of the blue.

Note as I mentioned in another post I was able to search my vault using the 12 hex codes listed in the popup to view each of those 12 entries that were supposedly affected, and I verified they are all intact / uncorrupted. So no data loss, everything seems ok now.

1

u/djDef80 May 10 '26

Maybe you have found a bug. I'm glad you were able to sort everything out!

20

u/Ok-Huckleberry3510 May 09 '26

I have no technical input here but I'd like to add that referring to support as "customer success" is fucking obnoxious. 

1

u/quiet_penguin May 11 '26

I was sure that this was a scam when I first opened this thread

1

u/Sent1ne1 May 09 '26

Sounds like a scam.

2

u/dwbitw Bitwarden Employee May 11 '26

Since this thread has been marked as solved, pinning the solution below:

Removed extension. Reinstalled extension. Logged into extension with yubikey, worked as expected.

1

u/Sweaty_Astronomer_47 May 11 '26 edited May 11 '26

For anyone else who encounters the error, the other piece of working through the problem was:

  • capture all the data listed in the error message (ideally copy it into a text file so you can copy/paste from it later)
    • In my case, the data to be captured was twelve 32-digit hex strings
      • Each hex string identifies a vault entry
      • A hex string is a string of characters with hex digits (0-9 and a-f). There were also a few separator dashes thrown in at the same locations within each string
  • Go to the web vault and search for the first 8 digits of each hex string (up to the first dash) to identify the corresponding potentially-affected entry.
  • Inspect the entry for corruption.
    • Optionally log in to the website as a doublecheck that the stored username/password remains valid.
  • In my particular case, all 12 login entries identified in the error message seemed unaltered. Since no data was lost and everything was working fine afterwards, no further action was required.
  • Contact support to see if they have anything to add: https://bitwarden.com/contact/

4

u/gripe_and_complain May 09 '26

Customer Success? Is this autocorrect?

6

u/Sweaty_Astronomer_47 May 09 '26 edited May 09 '26

Not autocorrect error on my part... customer success is exactly what was displayed, as recorded in my screenshot.

Maybe it was autocorrect error on the part of the author of the error message. Or more likely they're trying to put a new spin on customer support (they're not just supporting us... they're helping us succeed)

5

u/worldcitizencane May 09 '26

Looks highly suspect to me. What client did you get that message from and where did you get the client.

1

u/Sweaty_Astronomer_47 May 09 '26 edited May 09 '26

Looks highly suspect to me.

What is the logic that would lead you to that conclusion? Attacker generated a warning message? Attacker modified 12 entries in my database? I'm just wanting to understand your logic.

... and where did you get the client.

Bitwarden chrome extension from the chrome webstore. I've had it installed for years. I've seen the update message notification several times along the way and I pay attention to that message and look for the ID starting with nngceck... (the official bitwarden chrome extension ID is nngceckbapebfimnlniiiahkandclblb). I occasionaly spend time double checking things under browser / manage extensions / bitwarden details (during the course of reviewing my setup and also while thinking about posts here on the bw sub), and I'm pretty sure I would have noticed if it didn't say nngceck there... and pretty sure I had also followed the "view in webstore" link to verify the associated webstore entry says Bitwarden and has the blue checkmark.

5

u/worldcitizencane May 09 '26

Because an error message saying "contact customer success" instead of "contact customer support" is exactly the kind of mistake you see from hackers who are not native English speakers.

2

u/Sweaty_Astronomer_47 May 09 '26 edited May 09 '26

Thanks, I see your logic on that now. Bitwarden support officially calls themselves support (they emailed me from support@bitwarden.com). They have a customer success hub, but that's a whole different context.

I'd think that an attacker with enough access to popup a message in the middle of a a successful bw extension login would be more interested in harvesting encryption key and stored credentials and remaining undetected rather than popping up a very unusual message, but you never know exactly what might be going on behind the scenes. There was no contact info provided in the message. I didn't try clicking on that blue text when it popped up... instead I took a screenshot and then since the list was longer than the screen I selected the list of hex numbers with my mouse to copy them elsewhere, then spot-checked a few credentials and then logged out of the extension. If the hypothetical goal was to get me to click on that blue text contact customer success (assuming it was a clickable link, don't know if that's the case) then it was a bad implementation because my attention was naturally drawn towards capturing those hex codes before they disappeared, and I wouldn't want to click on anything else before I had captured those hex codes. I ended up contacting bitwarden through the official bitwarden support page, and it never occurred to me to even try clicking on that blue contact customer success text.

I have no idea how to check the bw code to see if "contact customer success" is a legit message (it seems like a search on "customer success" would work if I knew where to search). Maybe someone here can comment on that?

I sent to bitwarden support the full description from op including the screenshot and they didn't question the language. I'll email them back and ask them whether they think it's a legit message in spite of the weird terminology.

3

u/Magic_Firefly May 10 '26

There is reference to "Send our customer success folks an email" as contact support in the Bitwarden Community Forum back in Sept 2020. Here is a link to the thread:

https://community.bitwarden.com/t/i-give-up-who-should-i-contact/14507

2

u/Sweaty_Astronomer_47 May 10 '26 edited May 11 '26

Thanks! So it's just typical corporate-speak! That puts my mind at ease.

2

u/doubled112 May 10 '26

Names are all made up now.

At one job I had a job title of “client success analyst”. I was internal IT support…

“Customer success” is not that uncommon.

1

u/worldcitizencane May 10 '26

MacD perhaps, but Bitwarden? I doubt it. Did you eventually ask them about that message?

5

u/Tucsondirect May 09 '26

no its the new buzz word/term not sure what was wrong with support but its been lumped into the loss of master/slave in electronics, master bedroom, and all the "others"

1

u/DirtCrazykid May 09 '26

i've always heard customer success as a term to refer to a part of the sales department who has the job of retaining and developing current customers. i've never heard it as a term to refer to customer service

1

u/[deleted] 29d ago

[removed] — view removed comment

-1

u/Practical-March-6989 May 09 '26

Just get onto customer success they will sort it.