bitwarden / clients

Bitwarden client apps (web, browser extension, desktop, and cli).
https://bitwarden.com
Other
9k stars 1.18k forks source link

Windows desktop client shows email in upper right account info on login screen despite Remember email not being checked #10367

Open sylerner opened 1 month ago

sylerner commented 1 month ago

Steps To Reproduce

  1. Go to 'login screen'
  2. Account information (email address and server) is shown in upper right corner in blue bar
  3. Email address field is empty (as it should be)
  4. Remember email is not checked

Expected Result

The account email address should not be displayed anywhere when logged out. Lack of the account's email address is a major part of vault security and is the reason many choose to not have their email address automatically filled into the email field.

Actual Result

The account's email address is compromised.

Screenshots or Videos

Additional Context

No response

Operating System

Windows

Operating System Version

Windows 11 Home 23H2

Installation method

Direct Download (from bitwarden.com)

Build Version

Version 2024.7.1, Shell 31.2.0, Renderer 126.0.6478.127, Node 20.15.0, Architecture x64

Issue Tracking Info

sylerner commented 1 month ago

Bitwarden windows client

TroyBW commented 1 month ago

Hi there,

I am unable to reproduce this issue, it has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!

sylerner commented 1 month ago

System info:

I am using a few older Yubikey devices in OTP mode for second factor authentication.

The showing of account information persists after logout/login and even restart.

To recreate, in settings, set "Vault timeout action" to "Log out".

If you exit Bitwarden by selecting File, Logout, , the account information isn't shown in the blue bar.

If however, you exit Bitwarden by either:

the account information will display in the blue bar in a very persistent manner.

BTW, I discovered that when the account information is being showed in the blue bar on a login screen, clicking the account information brings a dropdown that includes "Add account". Clicking on "Add account" makes the account information disappear.

sylerner commented 1 month ago

I tried things out on Linux (OpenSuse Tumbleweed) and found that exiting Bitwarden with ctrl-Q or ctrl-W caused the same behavior. When next opening Bitwarden, my email is shown in the upper right in the blue bar.

Interestingly, when testing alt-F4, I discovered that it closed the window to the system tray instead of closing the app. Invoking Bitwarden in this state brings you back to your open vault. Alt-F4 neither locks or logs out on Linux.