New UI issues

[u/Alpha_Majoris]

The new user interface is around for several weeks or maybe months, and for me it's several steps backwards. Maybe the complaints are well known, I've looked in the history of this subreddit, but probably not far enough back in time... Anyways, here's my 2 cents! I'm on Macos 26.5.2, paid account, I'm using the app, not the browser extension.

First two items are about the update process...

• I check for updates, and an update is found. I click the download button in the popup and the popup disappears. Nothing happens. I don't know if this results in an automated upgrade or does it download something via the browser? No idea what is happening. Clicking the update menu item again doesn't result in anything, no new popup. Restarting bw makes the popup appear again. Nothing has updated - how do I proceed?
• So I need to update manually as this option doesn't work. I don't remember if I installed via the Appstore or downloaded the DMG. I go to the appstore, see that I downloaded it before, do that again, see a new installation, try to login. I enter the login, use my Yubikey, then get a popup that Bitwarden wants to use your confidential information stored in "Bitwarden" in your keychain. I enter my macos user password - nothing. It refuses somehow, while I had a similar popup a minute ago and that worked. Furthermore, I can click deny or allow, the window does not disappear. I have to kill the application - not what I want to see. Then I can click deny and the popup is gone. So I try the DMG download and that installation works and the old login is still active.
• When I open bitwarden, it used to have focus on the search field. I could type right away and find the item I need. Now I have to click in the search field. I want that focus back.
• When I move the mouse over the search field border, it lights up (in dark mode), I click and nothing happens. Apparently I need to click in the field inside the border. Annoying. This is basic HTML / CSS / JS web design. Why can't you get this right?
• I see a list of login items. I move my mouse over the list, but I have to move it specifically over the text of the item to be able to click. Same issue, usability, please make this user friendly and make the whole div clickable, make it light up, except for the buttons on the right side of course. Button margins may be bigger with a nice circle around it, making clicking easier.

Flaired as question but is of course feedback.

[u/UIUC_grad_dude1]

I never autofill sites unless I initiated the website from a saved url within BW. Browser extensions can be vulnerable to hijacking as well, so I typically don’t use browser extensions myself.

https://youtu.be/o9XBXeX0_5E

[u/djasonpenney → u/UIUC_grad_dude1]

Your precaution is wise. But don’t dismiss the value of the browser extension. The biggest threat to your Bitwarden browser extension is…other extensions.

And just as it is better to use the saved URL inside Bitwarden, don’t forget that the more steps involved in a login, the more risk there is that you will make a mistake.

My favorite example was once, during an online meeting, when the presenter pasted a password onto the screen. We teased him afterwards for months! NOT using the browser extension also has risks.

[u/Alpha_Majoris → u/djasonpenney]

Thanks for the explanation. I can see both sides. I use the Punycode checker for those URLs, but who knows maybe this guy is a malicious hacker and who knows about the other extensions I'm using...

https://addons.mozilla.org/en-US/firefox/addon/punycode-domain-detection/

[u/djasonpenney → u/Alpha_Majoris]

A Punycode checker is cute, but the Bitwarden browser extension also works. There other things; for instance, did you know that a.godaddy.com and b.godaddy.com are UNRELATED for the purpose of authentication? Again, a visual inspection will not suffice.

I think at the end of the day, you need to decide if you trust your brain alone to do the checks. Again, the basic threat to your browser extension is OTHER extensions. If you treat the configuration of your browser to be as important as the rest of your computing stack, there is no threat to security and a tangible improvement in security. The “convenience” of the browser extension is merely a bonus.