Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

bitwarden.com

Post reply on HN
Print view View original

51–60 of 138 posts

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#51

Post by zem »

sakisv wrote: post #30

That's very nice, well done! For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so mechanically when I'm on my laptop, that I really struggle to remember it when I have to type it on a screen - to the point that I must go sit at a computer open a notepad, let muscle memory take over and then look at the screen to see what I typed /facepalm An…

i use a regular english sentence as my master password; seems to strike the right balance between not brute-forceable and easy to remember. am i missing some potential drawback to doing that?

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#52

Post by Narushia »

syncerr wrote: post #44

Passwordless is going to be great. Though, this is just for unlocking your bitwarden account. Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If yo…

Sadly, the demo didn’t seem to work on my devices. Tried it on desktop Chrome and my Android phone (Galaxy S22); Chrome says that a "notification was sent" to the phone, but there’s nothing. Seems like it’s supposed to work wirelessly, but I didn’t have any success via a USB cable either. Android Chrome does react to it, and shows that it’s connected, but desktop Chrome’s dialog keeps just spinning until it times out.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#53

Post by ReaLNero »

zem wrote: post #51
sakisv wrote: post #30

That's very nice, well done! For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so mechanically when I'm on my laptop, that I really struggle to remember it when I have to type it on a screen - to the point that I must go sit at a computer open a notepad, let muscle memory take over and then look at the screen to see what I typed /facepalm An…

i use a regular english sentence as my master password; seems to strike the right balance between not brute-forceable and easy to remember. am i missing some potential drawback to doing that?

One thing to consider is that you can infer your password structure by ear (e.g. how many times the space bar was used, any modifier keys), making dictionary attacks much scarier, especially if your threat model includes people in close proximity/public areas.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#54

Post by lillecarl »

lnxg33k1 wrote: post #41
xoa wrote: post #20

Earlier quoted context omitted.

As well as what sibling said about it being E2EE and just using a standard API for storage, there are awesome tools these days so you can (and I think should) lock down your instance fairly well. Now when I run services like that I access them exclusively via WireGuard or Nebula, no exposure to the public internet at all. It's reliable, dependable and performant enough to pretty much put everything inside of by defau…

I have my own instance at home as non business user, also residential connection with dynamic IP, and I've picked to connect through ZeroTier, a private VPN based on wireguard

ZeroTier is definitely not based on WireGuard, it's its own custom protocol. Just thought you should know. It's their own and it used to be marketed as "a global network switch", it operates with 2400 MTU and fragments your packets when sending them (because MTU is 1500 on the internet). It also means you can send data over ZeroTier without IP addresses, broadcast and multicast should work too.

However, it's not WireGuard. WireGuard operates on L3, there's no L2 headers, you can't run MPLS over it, you can't add VLAN tags to it, you route all the traffic.

As long as you're not bridging yourself into the ZeroTier network there shouldn't be any issues though, but fragmenting always kills performance.

TL;DR: ZeroTier is not based on WireGuard.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#55

Post by cmdli »

sebk wrote: post #50
cmdli wrote: post #48

Earlier quoted context omitted.

If you are looking for something like a password manager but for passkeys, I would like to plug my own product Bulwark Passkey ( https://bulwark.id ). It allows you to sync accounts across devices and is entirely open source. Overall, I think what passkeys need right now is more flexibility. Nobody is going to switch to passkeys if they are locked to their Apple account, for example.

Thank you for having an honest FAQ, especially about keys not being backed by hardware and its implications. Some competitors implementing a comparable mechanism have been very quiet about it and have severely undermined my trust in them. Hopefully we'll see OS and hardware vendors provide APIs so that third party passkey managers can leverage secure hardware in the future.

Yeah, trust is a big thing for me when it comes to security software, so I wanted to be upfront about what the software is good/bad against. I personally think that moving away from passwords is worth it, even if the credentials aren't stored in silicon, but I can appreciate those people who want their keys stored as securely as possible.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#56

Post by sandworm101 »

zem wrote: post #51
sakisv wrote: post #30

That's very nice, well done! For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so mechanically when I'm on my laptop, that I really struggle to remember it when I have to type it on a screen - to the point that I must go sit at a computer open a notepad, let muscle memory take over and then look at the screen to see what I typed /facepalm An…

i use a regular english sentence as my master password; seems to strike the right balance between not brute-forceable and easy to remember. am i missing some potential drawback to doing that?

>> am i missing some potential drawback to doing that?

My work machines (government) check for "commonly used words" and will generally reject natural language even if squashed between punctuation marks. "P@ssword" would probably slip through, but "GodIHateRememberingAllTheseStupidPasswords!@#!@" doesn't.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#57

Post by Someone1234 »

Someone1234 wrote: post #4
sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Because it uses Docker and that is what Docker requires.

They're literally taken from Docker's website:

- https://docs.docker.com/desktop/install/linux-install/

HN has reached the point, that it will heavily downvote an objective fact because it goes against the pointed narrative. They took a dependency, copied its system requirements, and someone asks "why?" and that is the actual answer.

A lot of the other answers (multiple Dockers, slimmer image) really address how Docker themselves have these exact system requirements listed, but why do they need to when the point isn't to answer the actual request asked by get lost into a predisposed critique.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#58

Post by freeplay »

sneak wrote: post #49
palata wrote: post #42

Earlier quoted context omitted.

How do you mean that?

A compromised Apple developer account login pushing out a compromised Bitwarden mobile app to the Apple App Store that steals everyone's master passphrases.

Valid question.

Although how could any product protect against that kind of attack? If the supply chain is compromised, it's pretty much a wrap.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#59

Post by postalrat »

cmdli wrote: post #47
syncerr wrote: post #44

Passwordless is going to be great. Though, this is just for unlocking your bitwarden account. Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If yo…

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device,…

IMO having devices that can be cloned will always be a weakness. Backup devices work fine.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#60

Post by deadbunny »

Someone1234 wrote: post #57
Someone1234 wrote: post #4

Earlier quoted context omitted.

Because it uses Docker and that is what Docker requires.

They're literally taken from Docker's website: - https://docs.docker.com/desktop/install/linux-install/ HN has reached the point, that it will heavily downvote an objective fact because it goes against the pointed narrative. They took a dependency, copied its system requirements, and someone asks "why?" and that is the actual answer. A lot of the other answers (multiple Dockers, slimmer image) really address how Dock…

Who on earth is using Docker Desktop to run anything but dev? Especially on Linux.

Side note: WTF is Docker Desktop on Linux using a VM? I can't even.

Post reply on HN