Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

bitwarden.com

Post reply on HN
Print view View original

41–50 of 138 posts

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#41

Post by lnxg33k1 »

xoa wrote: post #20
thewataccount wrote: post #11

Earlier quoted context omitted.

I've been considering vaultwarden, question though. I assume bitwarden's implementation has been more thoroughly reviewed. Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?

As well as what sibling said about it being E2EE and just using a standard API for storage, there are awesome tools these days so you can (and I think should) lock down your instance fairly well. Now when I run services like that I access them exclusively via WireGuard or Nebula, no exposure to the public internet at all. It's reliable, dependable and performant enough to pretty much put everything inside of by defau…

I have my own instance at home as non business user, also residential connection with dynamic IP, and I've picked to connect through ZeroTier, a private VPN based on wireguard

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#43

Post by 542458 »

Yujf wrote: post #28
heresjohnny wrote: post #16

Earlier quoted context omitted.

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Better security for sure. Bitwarden is a massive target while I am not. The chance that bitwarden has a databreach is way bigger than the chance that my server gets hacked. No one cares about my server, I am nobody not worth attacking. As long as I don't leave any big holes that can be found by an untargeted attack (which I won't, I run everything behind a personal VPN) it is safer.

> I am nobody not worth attacking.

You’re probably not worth individually attacking, but a brief look at the failed ssh login logs of any insignificant server shows that you probably are worth automated attacks… so I suppose the question is “Are you more vulnerable due to a) the risk of getting pwnt by an automated attack (due to a misconfiguration or being even a little slow to install a critical patch) or b) due to the risk of bitwarden getting pwnt by a sophisticated targeted actor?”

Further complicating this math is the E2EE nature of it, so it’s not just enough to pwn a server, you’d need to also compromise the client application.

Actually, now that I think about it, if you can compromise the client you don’t even need to compromise the server. I’m not really sure under what scenarios running your own server would protect you in in that case.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#44

Post by syncerr »

Passwordless is going to be great. Though, this is just for unlocking your bitwarden account.

Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If you haven't seen it, Auth0's demo is helpful[2].

[1] https://www.w3.org/TR/webauthn-3/#sctn-api

[2] https://webauthn.me/

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#45

Post by phpisthebest »

Yujf wrote: post #28
heresjohnny wrote: post #16

Earlier quoted context omitted.

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Better security for sure. Bitwarden is a massive target while I am not. The chance that bitwarden has a databreach is way bigger than the chance that my server gets hacked. No one cares about my server, I am nobody not worth attacking. As long as I don't leave any big holes that can be found by an untargeted attack (which I won't, I run everything behind a personal VPN) it is safer.

The entire purpose of bitwarden is they do not have your unencrypted data in the first place, so what is the fear there?

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#46

Post by phpisthebest »

sam_goody wrote: post #25
heresjohnny wrote: post #16

Earlier quoted context omitted.

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Sure. Hosting your own is a twenty minute setup, more or less, and $5/mo on Hetzner. Uptime, in my experience, is 5 nines. With SaaS, I am losing the main reason that I am using Bitwarden - that I don't want the X agency to force Bitwarden to give them my passwords. And I know that if said agency (it varies by country and target) could definitely hack the VPS if I was important enough, that is not part of my threat p…

>> I don't want the X agency to force Bitwarden to give them my passwords.

Then you do not understand how bitwarden works,

Bit Warden has the same access to your passwords that Hetzner does, i.e they have only encrypted access to the binary storage.

The only thing agency X could get from bitwarden is an encrypted vault that is useless with out your master key, all encryption and decryption is done client side. THis by the way is the same access Hetzner would have to turn over if Agency X asks for a copy of your VM running vualtwarden

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#47

Post by cmdli »

syncerr wrote: post #44

Passwordless is going to be great. Though, this is just for unlocking your bitwarden account. Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If yo…

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything.

As a side note, if you want to try out passkeys now and don't want to tie it to your device, I would like to plug my solution, Bulwark Passkey (https://bulwark.id). It's open source, allows you to export your credentials if you want, and supports all browsers since it emulates a virtual USB device.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#48

Post by cmdli »

OJFord wrote: post #15

Unfortunately no plans to offer it for third-party stored credentials though - this is just for 'unlocking' Bitwarden itself. 'Passwordless' badly needs 'password manager' support, or other cross-platform implementation, IMO.

If you are looking for something like a password manager but for passkeys, I would like to plug my own product Bulwark Passkey (https://bulwark.id). It allows you to sync accounts across devices and is entirely open source.

Overall, I think what passkeys need right now is more flexibility. Nobody is going to switch to passkeys if they are locked to their Apple account, for example.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#49

Post by sneak »

palata wrote: post #42
yasp wrote: post #12

How does Bitwarden protect against a malicious mobile app update?

How do you mean that?

A compromised Apple developer account login pushing out a compromised Bitwarden mobile app to the Apple App Store that steals everyone's master passphrases.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#50

Post by sebk »

cmdli wrote: post #48
OJFord wrote: post #15

Unfortunately no plans to offer it for third-party stored credentials though - this is just for 'unlocking' Bitwarden itself. 'Passwordless' badly needs 'password manager' support, or other cross-platform implementation, IMO.

If you are looking for something like a password manager but for passkeys, I would like to plug my own product Bulwark Passkey ( https://bulwark.id ). It allows you to sync accounts across devices and is entirely open source. Overall, I think what passkeys need right now is more flexibility. Nobody is going to switch to passkeys if they are locked to their Apple account, for example.

Thank you for having an honest FAQ, especially about keys not being backed by hardware and its implications. Some competitors implementing a comparable mechanism have been very quiet about it and have severely undermined my trust in them. Hopefully we'll see OS and hardware vendors provide APIs so that third party passkey managers can leverage secure hardware in the future.
Post reply on HN