101–110 of 118 posts
Earlier quoted context omitted.
Bitwarden. Works well and the integration with 2FA/TOTP is amazing. I highly recommend to not rely on a single (mobile) device for 2FA. Loosing or breaking it might shut you out of certain accounts forever.
I find Authy on a mobile and desktop with backup turned on seems like solid enough 2FA redundancy.
These audits are reassuring, but I'm hoping someone can speak to a question I have... I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent. Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on t…
Quick googling on this topic says that as of 2018 they were using authenticated AES-CBC.
These audits are reassuring, but I'm hoping someone can speak to a question I have... I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent. Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on t…
I don't see PBKDF2 as a full footgun, but maybe as the minimally still-acceptable method. When I was building my system for E2E messaging (pritact.com) I started out with PBKDF2 but kept mentally revisiting the iteration count before biting the bullet and switching to Argon2. Actually it looks like Argon2 is being discussed as of just a couple hours ago https://community.bitwarden.com/t/switch-to-argon2/350/24
Tangential question: What password manager do you guys use?
I intentionally use other things for my 2FA and TOTP so that my most important accounts are still not accessible even if you somehow get into my password manager. I use YubiKeys where I can, Google Authenticator when it has to be TOTP.
Tangential question: What password manager do you guys use?
I found LastPass painful to use and sync between local vault and server side to be broken. No thought has been given to layout, commonly used options are buried and basic things like selecting the right credentials by subdomain do not work. Their recent UI refresh has simply made things slower rather like Google's admin UIs. They have rather annoyingly decided, against NCSC advice, that I need to see a reminder to pointlessly cycle my master password every time I log in.
The final straw was when they applied a large renewal charge without authorisation to a card they were not given permission to keep and then mishandled the resulting complaint in every way you could possibly imagine.
Bitwarden is cheaper and far more usable, I can't find any single thing that LastPass does better for twice the price.
Which password manager(s) would you guys suggest for a team of 10-15?
These audits are reassuring, but I'm hoping someone can speak to a question I have... I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent. Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on t…
Stretching isn't magic. If your password is 'jszymborski' then no practical KDF will prevent bad guys just guessing "Um, maybe it's just jszymborski?" and getting in. And on the other hand if it's two dozen random alphanumerics you can use SHA256() as your KDF and be absolutely fine.
Because their users will (even if told emphatically not to) use bad passwords, Bitwarden needs a PBKDF with stretching here to buy those people more margin, but nit-picking the choice of PBKDF is missing the wood for the trees. As an end user the right thing to do regardless is use good passwords, which of course is how we got here...
Problem with Bitwarden etc. is that if your computer or one of the devices gets compromised, then all of your passwords are lost at the same time. With hardware based vault you can mitigate this somewhat, with rate-limiting, physical prompt etc.
I have 1600 passwords, I use perhaps 10 different per week. If I get compromised I loose 1600 passwords, but with hardware based system I potentially loose just the 10 I used within the last week.
I'd like to see a Open Source password vault which relies on open hardware storage for passwords. Clients only get rate-limited amount of passwords when the hardware is prompted to give, e.g. from physical button confirmation on the hardware, finger print. Point being that clients don't hold the passwords, just the usernames. Problem with Bitwarden etc. is that if your computer or one of the devices gets compromised,…
These audits are reassuring, but I'm hoping someone can speak to a question I have... I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent. Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on t…
PBKDF stretching is a mitigation against bad passwords. The difference between PBKDF2 and argon2id is marginal because you'd need to have chosen a password that's in a narrow window between "So bad that PBKDF2 doesn't save you" while "Not so bad that argon2id can't save you either". Stretching isn't magic. If your password is 'jszymborski' then no practical KDF will prevent bad guys just guessing "Um, maybe it's just…
However, they need a cross platform solution that integrates with .NET and will also work on a budget smartphone. I've sketched out such an architecture, but I lack the time and budget to do it.