vault.bitwarden.com inaccessible via current Internet Protocol

[UnderEu]

Code Contribution Proposal

The BitWarden vault service (vault.bitwarden.com) is inaccessible for users using the current Internet Protocol a.k.a. IPv6.

Proposed in 1995 (RFC 1883) and established as Internet Standard in 2017 (RFC 8200), the Internet Protocol version 6 is the new standard for internet access worldwide. Due to addresses exhaustion of the now legacy protocol version (IPv4), new ISPs & content providers have no option other than adopting this protocol, otherwise such services must work in very complex, not to say unnecessary, workarounds to mitigate the issue which leads to performance + connection reliability issues, cost increases and no futureproofing whatsoever.

Matter of fact, most cloud providers are charging extra to provide legacy IP connectivity in their services. Migrating to the current protocol version is not only a technology improvement but also a cost-saving measure for projects as big as this, especially FOSS-based.

; <<>> DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu <<>> AAAA vault.bitwarden.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16627
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;vault.bitwarden.com.		IN	AAAA

;; ANSWER SECTION:
vault.bitwarden.com.	26	IN	CNAME	n.sni.global.fastly.net.

;; AUTHORITY SECTION:
fastly.net.		26	IN	SOA	ns1.fastly.net. hostmaster.fastly.com. 2017052201 3600 600 604800 30

;; Query time: 12 msec
;; SERVER: 2606:4700:4700::1001#53(2606:4700:4700::1001) (UDP)
;; WHEN: Sat Apr 20 18:33:47 -03 2024
;; MSG SIZE  rcvd: 143

[Tipoff4317]

That's interesting. I can't resolve vault.bitwarden.com to an IPv6 address either, but 10 months ago could. Did they change something? I wouldn't be surprised if they intentionally did this to be able to block attacks based on IP addresses, which is most likely harder to do with IPv6.

ps: In fact, the names that used to resolve to IPv6 addresses including api., identity., notifications.* now all only have IPv4 addresses. I think they likely did this intentionally.

[thomasschaeferm]

They probably use a CDN in front. With tricks it resolves to

2a04:4e42:8e::347

[Rayrob]

Fastly documentation states to use CNAME dualstack.n.sni.global.fastly.net for dualstack.
This appears to work fine using hosts file entries to override DNS. I recall Spotify did exactly the same thing when they (briefly) used Fastly.
https://docs.fastly.com/en/guides/ipv6-support

[UnderEu]

For now, those hosts entries are doing the trick for me

2a04:4e42::347 vault.bitwarden.com
2a04:4e42::347 identity.bitwarden.com
2a04:4e42::347 notifications.bitwarden.com
2a04:4e42::347 api.bitwarden.com
2a04:4e42::347 icons.bitwarden.net

2a04:4e42:600::347 vault.bitwarden.com
2a04:4e42:600::347 identity.bitwarden.com
2a04:4e42:600::347 notifications.bitwarden.com
2a04:4e42:600::347 api.bitwarden.com
2a04:4e42:600::347 icons.bitwarden.net

2a04:4e42:200::347 vault.bitwarden.com
2a04:4e42:200::347 identity.bitwarden.com
2a04:4e42:200::347 notifications.bitwarden.com
2a04:4e42:200::347 api.bitwarden.com
2a04:4e42:200::347 icons.bitwarden.net

2a04:4e42:400::347 vault.bitwarden.com
2a04:4e42:400::347 identity.bitwarden.com
2a04:4e42:400::347 notifications.bitwarden.com
2a04:4e42:400::347 api.bitwarden.com
2a04:4e42:400::347 icons.bitwarden.net

[Tipoff4317]

2a04:4e42:8e::347

I forced syncing on the FF extension and look in about:networking#dns. Here are the names used by BW:

identity.bitwarden.com
notifications.bitwarden.com
api.bitwarden.com

All resolved to IPv4 addresses now. IPv6 resolutions for my other sites work fine. Looking up vault.bitwarden.com using online tools also mostly return no IPv6 records. I am not sure, but this looks broken. Hopefully, this doesn't turn into more infamous Connection 6 errors.

[fzakfeld]

As a paying customer I'd like to see bitwarden catch up. Given that most ISPs in my country are now using multiple layers of NAT to support IPv4, the only proper solution in the long run is to support IPv6.

Also some are already preparing for an IPv6-only internet (https://konecipv4.cz/en/). It's a matter of time until the first ISPs will drop IPv4 support.

[Hinton]

Hi all,

This space is used for proposing code contributions you wish to work on for the official Bitwarden codebase. Since this isn't related to a code contribution this is the wrong place and more suited for our support team to assist with. Please have a look at our help center or reach out directly to our support team.