Browser: Auto logout by idle timeout

[ke-d]

Perhaps add an option to have the extension detect when the user is idle before counting down the timer to log out. Thanks for your hard work!

https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/idle

[kspearrin]

Good idea. Didn't know about this API.

[kspearrin]

added "On Locked" option for next release: https://github.com/bitwarden/browser/commit/96be6466412dbfac8b6a0f24fd10c1b2c4c0138e

[ke-d]

Nice that was fast.

[ke-d]

I just tried it out by building it. It's a good start but I think it should be like a checkmark under lock items named "Check if idle". Then if idle ->count down the timer depending on what the user sets.

Use case:
Settings: {Check if idle: true, timer: 5 minutes}

• User logs into the extension
• While user is actively using the browser the extension doesn't lock
• Only when the user leaves the computer and browser state is idle, then the timer will tick down
• When the timer counts down to 0, then it will lock
• Say 1 minute (or whatever you want or provide options) to check if idle + 5 minute timer = 6 minutes to lock the extension after idle

[kspearrin]

Kenny,
I still plan to add other options like you mentioned. This was just a quick win I got out of checking out the new API that I could get in with this release.

One problem that we will have to solve to get the effect you are looking for is what is the definition of "idle". The API doesn't just tell you when the user is idle, you have to tell it what idle means by specifying a number of seconds on inactivity. See https://developer.chrome.com/apps/idle#method-setDetectionInterval

So how should we define idle?

[ke-d]

From what I remember, how Lastpass does it is they have a separate drop down menu for idle timer. So the user can choose how long before the browser determines when it is "idle".

[kspearrin]

Seems like a lot of configuration. Need to think about this more.

[ke-d]

Another option like I said before is to have a checkbox "Check if idle" then you can decide how long "idle" would be, but it would be handy to have another drop down menu.

[jungle-boogie]

I support this request. On accident I opened a request at core, but this is really a browser thing.

I think a simple auto logout of 30/60/90 minutes wouldn't be too complicated for users.

https://github.com/bitwarden/core/issues/146

[ToNIX-]

I'd also like to see a logout after X mins of idle instead of a fixed time.

[bricep]

I agree that an idle lockout is pretty much a necessity. It looks like the idle API could be used here and is compatible across most browsers:

https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/idle

[kustodian]

I really like how LastPass did it. It only works with idle times and there are two separate idle times:

• while browser is running
• while the browser is closed

Here is how it looks like:

This means that you can configure to lock the vault after N minutes of innactivity or after a close (restart) of a browser. Bitwarden only has a timeout to configure either of the two, and you need both for security.

I would also suggest better sane defaults for Lock, because leaving Bitwarden unlocked all the time (if I remember correctly that is the default) is no the best option for the majority of users.

[kspearrin]

We are moving away from tracking Bitwarden feature requests like this one as GitHub issues. We have created a Bitwarden Community Forum which has a section for submitting, voting for, and discussing product feature requests. Please sign up on our forums if you want to continue contributing to feature requests.

Since this was a popular feature request we have already re-created it on the forums and linked back to this GitHub issue for reference. You can vote for this feature request there if you'd like.

https://community.bitwarden.com/t/on-system-idle-lock-option/33

This issue will now be closed. Thanks!

[ajayyy]

https://github.com/bitwarden/browser/pull/1159