Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden second security audit report

bitwarden.com

Post reply on HN
Print view View original

91–100 of 118 posts

Re: Bitwarden second security audit report

#91

Post by FabHK »

sneak wrote: post #31

https://github.com/bitwarden/jslib/issues/52 I am astounded to see this missing from the report. Apparently the report was just their external API configuration or something?

It wasn't in the scope of this audit, but it's still somewhat concerning... PBKDF2 with SHA-256 (a super fast hash with hardware support) as a key derivation function (which should be slow and difficult and hard to do in hardware)? That doesn't sound right. The answer provided (cross platform compatibility) doesn't sound satisfying.

Was this discussed with the prior audit?

EDIT to add: Here's the 2018 "cryptographically right answer" on password hashing ( https://latacora.singles/2018/04/03/cryptographic-right-answ... ):

Password handling

Percival, 2009: scrypt or PBKDF2.

Ptacek, 2015: In order of preference, use scrypt, bcrypt, and then if nothing else is available PBKDF2.

Latacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2.

You care about this if: you accept passwords from users or, anywhere in your system, have human-intelligible secret keys.

But, seriously: you can throw a dart at a wall to pick one of these. Technically, argon2 and scrypt are materially better than bcrypt, which is much better than PBKDF2. In practice, it mostly matters that you use a real secure password hash, and not as much which one you use.

Don’t build elaborate password-hash-agility schemes.

Avoid: SHA-3, naked SHA-2, SHA-1, MD5.

EDIT to UPDATE:

Bitwarden has commented (about an hour ago) that they'll fix this! Cool.

https://community.bitwarden.com/t/switch-to-argon2/350/23

https://github.com/bitwarden/jslib/issues/52

Re: Bitwarden second security audit report

#92

Post by jszymborski »

These audits are reassuring, but I'm hoping someone can speak to a question I have...

I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent.

Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on the client), PBKDF2 always felt to me like a footgun when compared to scrypt or argon2 which don't have as many (any?) insecure modes of operation.

The website states that AES is used, but is it in an authenticated mode (e.g. GCM ?)

Finally, their website states that they use "popular and reputable crypto libraries" and that they don't roll their own crypto, but the libraries they use are awfully low-level. Something like libsodium or FilSottile's age would be something I'd be more comfortable with when considering a hosted method.

In the meantime, I think I'll keep using KeePass2 (w/ Argon2 and ChaCha20) and synch'd with SyncThing to minimise my attack surface.

Re: Bitwarden second security audit report

#93

Post by rtempaccount1 »

dogma1138 wrote: post #85
raesene9 wrote: post #76

Earlier quoted context omitted.

Worth noting that (IME) US day rates are a lot higher for pentest work :) your US rates sound similar to what I've seen but Morrbo's UK rates sound ballpark right for the UK (I'd have said a little higher but it does depend on the company and work)

When I did pentesting for a consulting firm the daily rate was £2000-2500 (depending if we had to pay reverse VAT for non UK/SM clients, and some other factors) we worked with financial firms and software companies primarily, there for remote on-site would be the same + expenses. More bespoke services like proper red teaming, DDoS simulation IOT/connected cars/hardware were about double that. £800 a day is the very b…

Let me guess, Big-4? boutiques in the UK don't usually charge that kind of day-rate and the big banks all use their purchasing power to get day rates down.

£800/day is low, but not unheard of especially if you use freelancers/small boutiques, but £2k/days is more than I've seen for most things in the UK.

Re: Bitwarden second security audit report

#94

Post by user5994461 »

dogma1138 wrote: post #85
raesene9 wrote: post #76

Earlier quoted context omitted.

Worth noting that (IME) US day rates are a lot higher for pentest work :) your US rates sound similar to what I've seen but Morrbo's UK rates sound ballpark right for the UK (I'd have said a little higher but it does depend on the company and work)

When I did pentesting for a consulting firm the daily rate was £2000-2500 (depending if we had to pay reverse VAT for non UK/SM clients, and some other factors) we worked with financial firms and software companies primarily, there for remote on-site would be the same + expenses. More bespoke services like proper red teaming, DDoS simulation IOT/connected cars/hardware were about double that. £800 a day is the very b…

Sounds a bit much. Could you have names of firms running this sort of service? and are they recruiting?

When I was working in financial firms, there were internal red teams running vulnerability scanners or manual pentest (manual requires much more planning and coordination) . No point in paying external firms £10k per app to run an automated test. I am gonna have to consider changing side if audit firms are really billing £2-4k a day for this.

Re: Bitwarden second security audit report

#95

Post by chrismorgan »

graton wrote: post #79
codeknight11 wrote: post #13

Tangential question: What password manager do you guys use?

I use Bitwarden_rs ( https://github.com/dani-garcia/bitwarden_rs ) and self-host it in a Docker container on my Synology NAS. I only allow access to it from my internal home network. The nice thing about Bitwarden_rs is that you get features which you would have to pay for with normal Bitwarden. For example 2FA with U2F. As a note Bitwarden_rs is written in Rust.

That’s not what I would call the nice thing about bitwarden_rs. What I would call the nice thing is single-user total disk usage under 20MB and memory usage under 30MB, with totally negligible CPU usage. The official server requires SQL Server and quotes recommends 4GB of RAM and 25GB of disk space as a minimum, though I imagine the true minimum it could survive with would be a good deal less. (Still, I do appreciate being able to generate TOTP codes, which is paid functionality with the official server.)

Re: Bitwarden second security audit report

#96

Post by warkdarrior »

jszymborski wrote: post #92

These audits are reassuring, but I'm hoping someone can speak to a question I have... I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent. Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on t…

Their 2018 audit of the application code may answer your questions: https://bitwarden.com/blog/post/third-party-security-audit/

Re: Bitwarden second security audit report

#97

Post by lux »

gingerlime wrote: post #84
codeknight11 wrote: post #13

Tangential question: What password manager do you guys use?

I guess answers here will be skewed towards Bitwarden, because those who already use it will likely be more interested in this thread. I also use it at my company, and personally with my wife. Also got my mum to use it! At my company, we also use it for server secrets, using envwarden: a simple wrapper we created and open-sourced[0] for managing server secrets with Bitwarden. [0] https://github.com/envwarden/envwarde…

Love this and currently testing it for deployment at my company. Thanks for making it, it feels 1000x more straightforward than Vault, etc.

I'd love to hear an official stance on it from Bitwarden to know their take and whether they're considering supporting this important use case in an official capacity (e.g., sponsoringor providing some kind of support for the project). Seems like it could be a big differentiator over other password managers.

Re: Bitwarden second security audit report

#98

Post by raesene9 »

sillysaurusx wrote: post #90
raesene9 wrote: post #44

It's good to see companies making reports public to provide some confidence that they're having reviews done, but in this case the scoping of this job seems a little odd, not sure if that's a bad reporting template or something else. Last page of the PDF indicates that they just did an external VA and pentest, but looking at their product set , I'd have expected (at least) a review of the web, desktop and mobile apps…

Heh. You’re proposing around... well, ${a lot of money} worth of work. When I was a pentester, I once ran the numbers and concluded that each pen test must have cost some absurd amount of money for us to be profitable. And they do, because it’s effective. But I wanted to point out a likely possibility: they wanted to do what you were saying, and concluded a million dollars spent on a pentest was beyond reach. a revie…

Yeah I'm fairly well aware how pentests are billed (I've been in testing for ~15 years as a buyer, seller and tester :) )

My point was, that there was a gap between how the blog appeared to be billing the test "thorough security assessment and penetration test" and the report's statements around scope.

Obviously companies can't always afford all the testing that they need to get as much coverage as they could, but when your major selling product is a downloadable application, a comprehensive review would usually at least touch on it as part of the work performed, for it to be called thorough.

Re: Bitwarden second security audit report

#99

Post by peterloron »

chrismorgan wrote: post #95
graton wrote: post #79

Earlier quoted context omitted.

I use Bitwarden_rs ( https://github.com/dani-garcia/bitwarden_rs ) and self-host it in a Docker container on my Synology NAS. I only allow access to it from my internal home network. The nice thing about Bitwarden_rs is that you get features which you would have to pay for with normal Bitwarden. For example 2FA with U2F. As a note Bitwarden_rs is written in Rust.

That’s not what I would call the nice thing about bitwarden_rs. What I would call the nice thing is single-user total disk usage under 20MB and memory usage under 30MB, with totally negligible CPU usage. The official server requires SQL Server and quotes recommends 4GB of RAM and 25GB of disk space as a minimum, though I imagine the true minimum it could survive with would be a good deal less. (Still, I do appreciate…

While you can used the premium features without paying, I would strongly urge you to pay for a license anyway. It doesn't cost much and the Bitwarden folks are a small team doing a great product. I really like bitwarden_rs and wish the official server would adopt it or something similar. The official server is pretty darn heavy.

Re: Bitwarden second security audit report

#100

Post by codysc »

jszymborski wrote: post #92

These audits are reassuring, but I'm hoping someone can speak to a question I have... I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent. Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on t…

I don't see PBKDF2 as a full footgun, but maybe as the minimally still-acceptable method. When I was building my system for E2E messaging (pritact.com) I started out with PBKDF2 but kept mentally revisiting the iteration count before biting the bullet and switching to Argon2.

Actually it looks like Argon2 is being discussed as of just a couple hours ago https://community.bitwarden.com/t/switch-to-argon2/350/24

Post reply on HN