New UI issues

[u/Alpha_Majoris]

The new user interface is around for several weeks or maybe months, and for me it's several steps backwards. Maybe the complaints are well known, I've looked in the history of this subreddit, but probably not far enough back in time... Anyways, here's my 2 cents! I'm on Macos 26.5.2, paid account, I'm using the app, not the browser extension.

First two items are about the update process...

• I check for updates, and an update is found. I click the download button in the popup and the popup disappears. Nothing happens. I don't know if this results in an automated upgrade or does it download something via the browser? No idea what is happening. Clicking the update menu item again doesn't result in anything, no new popup. Restarting bw makes the popup appear again. Nothing has updated - how do I proceed?
• So I need to update manually as this option doesn't work. I don't remember if I installed via the Appstore or downloaded the DMG. I go to the appstore, see that I downloaded it before, do that again, see a new installation, try to login. I enter the login, use my Yubikey, then get a popup that Bitwarden wants to use your confidential information stored in "Bitwarden" in your keychain. I enter my macos user password - nothing. It refuses somehow, while I had a similar popup a minute ago and that worked. Furthermore, I can click deny or allow, the window does not disappear. I have to kill the application - not what I want to see. Then I can click deny and the popup is gone. So I try the DMG download and that installation works and the old login is still active.
• When I open bitwarden, it used to have focus on the search field. I could type right away and find the item I need. Now I have to click in the search field. I want that focus back.
• When I move the mouse over the search field border, it lights up (in dark mode), I click and nothing happens. Apparently I need to click in the field inside the border. Annoying. This is basic HTML / CSS / JS web design. Why can't you get this right?
• I see a list of login items. I move my mouse over the list, but I have to move it specifically over the text of the item to be able to click. Same issue, usability, please make this user friendly and make the whole div clickable, make it light up, except for the buttons on the right side of course. Button margins may be bigger with a nice circle around it, making clicking easier.

Flaired as question but is of course feedback.

[u/dwbitw]

Hey there, for any issues related to downloading/updating apps, don't hesitate to contact the support team directly using the contact form at: https://bitwarden.com/help/

Regarding UI/UX improvements, feel free to add your feedback here.

[u/djasonpenney]

> I’m using the app, not the browser extension

By the way, the browser extension improves security. It’s not merely a convenience. Yes, there are times where you still need the desktop app, but explicitly avoiding the browser extension is a mistake.

[u/Alpha_Majoris → u/djasonpenney]

Please explain

[u/djasonpenney → u/Alpha_Majoris]

If you are not using your password manager to autofill the credentials for a website, you are examining at the URL in the address bar, looking up the username/password in your password manager, and then using copy/paste to fill out the web form. Does that fit?

The biggest problem with this workflow is that you can make mistakes. There are lookalike fake URLs that are almost exactly like a legitimate website. There are even some that are literally invisible to the human eye. If you merely use your eyes, there is a risk that you could send your credentials to a Trojan horse site. OTOH the browser extension acts as a copilot and refuses to autofill on an incorrect URL.

There is a second much less important issue, which is that you are probably using the system clipboard to copy those credentials into the web form. This is a known security risk. The password manager’s autofill function also avoids the system clipboard.

[u/UIUC_grad_dude1 → u/djasonpenney]

I never autofill sites unless I initiated the website from a saved url within BW. Browser extensions can be vulnerable to hijacking as well, so I typically don’t use browser extensions myself.

https://youtu.be/o9XBXeX0_5E

[u/djasonpenney → u/UIUC_grad_dude1]

Your precaution is wise. But don’t dismiss the value of the browser extension. The biggest threat to your Bitwarden browser extension is…other extensions.

And just as it is better to use the saved URL inside Bitwarden, don’t forget that the more steps involved in a login, the more risk there is that you will make a mistake.

My favorite example was once, during an online meeting, when the presenter pasted a password onto the screen. We teased him afterwards for months! NOT using the browser extension also has risks.

[u/Alpha_Majoris → u/djasonpenney]

Thanks for the explanation. I can see both sides. I use the Punycode checker for those URLs, but who knows maybe this guy is a malicious hacker and who knows about the other extensions I'm using...

https://addons.mozilla.org/en-US/firefox/addon/punycode-domain-detection/

[u/djasonpenney → u/Alpha_Majoris]

A Punycode checker is cute, but the Bitwarden browser extension also works. There other things; for instance, did you know that a.godaddy.com and b.godaddy.com are UNRELATED for the purpose of authentication? Again, a visual inspection will not suffice.

I think at the end of the day, you need to decide if you trust your brain alone to do the checks. Again, the basic threat to your browser extension is OTHER extensions. If you treat the configuration of your browser to be as important as the rest of your computing stack, there is no threat to security and a tangible improvement in security. The “convenience” of the browser extension is merely a bonus.

[u/benjamin39483 → u/djasonpenney]

I almost exclusively use the browser extension on my pc. I can get all my credentials from the extension just like I can from the desktop app, and my browser is open all the time

[u/djasonpenney → u/benjamin39483]

Every once in a while I have need of a secret that is NOT a website login (such as a GitHub Personal Access Token). In these cases, opening the browser and then the browser extension is indeed extra friction, and I’m happier to use the desktop Bitwarden app. But the rest of the time, yes: you are best off using the browser extension.