Actually, I had no idea it could do that! That’s cool, and a point in Bitwarden’s favor. Thanks for sharing.
1password, which I use more of, doesn’t seem to — at least not to any appreciable amount that I can see. It does at least surface the app’s internal package name, but the first-time matching is manual and explicit (it gets saved to the entry afterward). On 1password there’s a process for this, though I also can’t remember it off the top of my head… it’s not super hard but not super easy either.
Side tangent / rabbit-hole…
This was interesting (and surprising) enough to me that I asked AI to look into the Bitwarden source code.
It did find this list: server/src/Core/Utilities/StaticStore.cs at main · bitwarden/server · GitHub, which has a listing of “this domain uses the same login as that one”, e.g.
GlobalDomains.Add(GlobalEquivalentDomainsType.Google, new List<string> { "youtube.com", "google.com", "gmail.com" });
But apparently it does not also store a mapping of those domains to the app internal IDs/names.
For iOS, apparently Apple just tells the password manager which domain an app or website is for, so it never has to guess. Bitwarden and 1password both use that — automatically, I guess, because they have no choice?
For Android, though, it’s the Wild West. Although there is a similar system for asking the question “Does the facebook.com domain officially associate itself with the package name com.facebook.katana? (example)”, apparently Android does not provide an easy, authoritative way to ask the inverse: “Which domain is the com.facebook.katana app associated with?” for password managers to use.
So they cheat and just reverse the app’s package name… Android package names are funny-looking because of an old Java convention, so Bitwarden will try to reverse com.facebook.katana into facebook.com and match on that.
1password does not do this… perhaps on purpose.
In fact this sort of reverse matching can be the source of phishing attacks: Phishing Attacks on Modern Android
If someone were to register and distribute an app called com.facebook.fake and you installed it, it could theoretically steal your facebook.com password via Bitwarden’s auto-fill. Hmm…
In fact Bitwarden already knows this and has a warning about it:
But I don’t think that goes far enough because it relies on Play Store/F-Droid reviewers to catch a malicious package name — and then gets amplified by all the “equivalent domains” from earlier, e.g. Microsoft is considered equivalent to 15 domains, including "bing.com", "hotmail.com", "live.com", "microsoft.com", "msn.com", "passport.net", "windows.com", "microsoftonline.com", and more. If an app manages to sneak through ANY of those domains as its package name, it can steal your Microsoft login. Bitwarden’s list is only updated every few months, and it already contains several dead links (I just checked).
So I guess your security in this case would depend on Play Store reviewers catching inappropriate package names that don’t actually belong to that developer =/ Android isn’t known for having the best malware-catching scheme, although that may get a little better with their upcoming forced and controversial developer verification system that’s rolling out this September. And if you sideload an app, all bets are off — they can have any package name, as long as it’s not already installed on your system.
Anyhow, normally I might say this would warrant at least a low-severity bug report to Bitwarden, but given that they already have that warning there, and that people generally frown upon AI-assisted bug reports these days (too much spam, low signal-to-noise ratio)… they probably already know it and just don’t think it matters enough. It’s not a huge risk, regardless.
1password’s model, in this case, is thus ever so slightly more secure, but a heckuvalot more annoying. Tradeoffs, as always!