Tangential question: What password manager do you guys use?
Roboform: is ugly and old, and it works
Bitwarden second security audit report
71–80 of 118 posts
Re: Bitwarden second security audit report
#72Earlier quoted context omitted.
The crowd sourcing stuff that I've seen comes in two different formats usually. There is the one where you put your URLs/IPs up there a d say "this is in scope"and someone finds something wrong, you pay them (ie. Someone says this has xss, you pay them a few hundred dollars) which has relatively little risk in terms of you only pay for what you get. The other ones are where you'd be allocated a test which then gets s…
Just for reference, the former example you give is just a bug bounty as far as I can tell. The discussion of relative merit of bug bounty versus a pentest is well trod ground, so I won't rehash here except to say I would never consider a bug bounty replacement for a pentest, and if you're asked for a pentest report as part of third-party vetting etc. many organizations will be concerned to see a bug bounty program co…
was going to say similar things. A bug bounty has value -- and its effectively to incentivise someone who finds a vulnerability to tell you, rather than exploit it or sell it to someone who will exploit it. Its the same as a pen test.
I dont want to name companies and start a war, but the industry is moving in a dangerous direction with some of the other options -- there are companies offering pen testing where those companies have no full time employees. They post the scope, and their registered users can sign in, take the work, and deliver it. Quality is all over the place. And things like confidentiality, data processing, etc, and any way to confirm a corporate entity adheres to their contractual obligations? Nonexistent.
Re: Bitwarden second security audit report
#73Tangential question: What password manager do you guys use?
Bitwarden, so does my (tech savvy but doesn't work in IT) wife. I'm using it in ipad OS, Android, Firefox, and Chrome. It works great with several different second authentication factors like hardware keys and the Google authenticator app.
One fantastic feature is that you can add the second factor 6 digit generator to a given password, just like an authentication app. When you log in by filling the username/password and hitting enter, your second factor is copied to the clipboard. That lets you just paste it in, which is very convenient for those annoying sites that make you log in with 2FA every 30 to 60 minutes.
Re: Bitwarden second security audit report
#74Tangential question: What password manager do you guys use?
KeePass.
I switched from KeePass to Bitwarden. KeePass worked great, but I decided it just wasn't worth it, as well as being potentially riskier, to manage it myself.
For example, if you use a third-party KeePass app on your phone, besides having to figure out a secure way to sync it, you also now have to trust the developer of the phone app as well. Larger attack surface.
Re: Bitwarden second security audit report
#75Re: Bitwarden second security audit report
#76Earlier quoted context omitted.
Pentester for 10 odd years: usually for an external test you would scope it at X days depending on the number of IPs etc. And it should note that an external test really doesn't find much. External is usually £750/day for 1-2 days testing and one reporting. Internal testing (ie. Auditing a domain and all computers attached) is about the same price, maybe a bit more, and takes a bit longer usually. A build review is h…
Appsec pentester for 6 or so years: The 1-1.2k a day figure (GBP) is relatively low for 2020. I know you mentioned that i's been a while; just trying to shed some light. Boutique Firm X billed at 285/hr with an average of 60 hours for a small application. That comes out to $2,280 USD a day. Standard Small Consulting Firm Y billed at 250/hr. In the past 6 years I have yet to see anything below 235/hr, which is still $…
Worth noting that (IME) US day rates are a lot higher for pentest work :) your US rates sound similar to what I've seen but Morrbo's UK rates sound ballpark right for the UK (I'd have said a little higher but it does depend on the company and work)
Re: Bitwarden second security audit report
#77Tangential question: What password manager do you guys use?
I'm currently using MacPass on macOS and KeePaasium on iOS, and syncing both through Dropbox. But that means I need my Dropbox credentials, in addition to the KeePass file secrets, if I lose both the Mac and the iPhone (after a fire or a robbery for example). Not sure I'm comfortable with that.
I'm considering switching to 1Password or Bitwarden. But I'm not sure about BitWarden using the same password both for encrypting the vault and accessing Bitwarden server. Chrome for example has an encryption password which is different from your usual Google Account password.
Re: Bitwarden second security audit report
#78Re: Bitwarden second security audit report
#79Tangential question: What password manager do you guys use?
I use Bitwarden_rs (https://github.com/dani-garcia/bitwarden_rs) and self-host it in a Docker container on my Synology NAS. I only allow access to it from my internal home network.
The nice thing about Bitwarden_rs is that you get features which you would have to pay for with normal Bitwarden. For example 2FA with U2F. As a note Bitwarden_rs is written in Rust.
Re: Bitwarden second security audit report
#80Tangential question: What password manager do you guys use?
I use Bitwarden_rs ( https://github.com/dani-garcia/bitwarden_rs ) and self-host it in a Docker container on my Synology NAS. I only allow access to it from my internal home network. The nice thing about Bitwarden_rs is that you get features which you would have to pay for with normal Bitwarden. For example 2FA with U2F. As a note Bitwarden_rs is written in Rust.
I also use Bitwarden_rs so I don’t have to host a MSSQL database, but it’s worth noting that the Bitwarden_rs server hasn’t been audited. It uses the same upstream clients (including web), but that doesn’t fully cover the implementation.