Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

bitwarden.com

Post reply on HN
Print view View original

121–130 of 138 posts

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#121

Post by UncleMeat »

phantomathkg wrote: post #91
martin_a wrote: post #90

Earlier quoted context omitted.

> MFA using an SMS is not secure. Why not? Is it that easy to intercept a SMS or is that just due to poor handling with some providers?

Yes it is. https://blog.mozilla.org/en/internet-culture/mozilla-explain...

SIM-swap is a real thing, but it has an unreasonably large amount of mindshare in discussions about login security in non-security communities. Phishing is a gazillion times more common because it actually scales. Both SMS and TOTP are equally weak to phishing, yet people frequently shit on services for using SMS and not TOTP.

SMS has weaknesses. Especially if you are a particularly high-interest target. But the benefit of "everybody already has a phone" is immense and the true recovery mechanism for "oh shit I dropped my phone in the toilet" is valuable. Something like a yubikey is the complete solution to login problems that don't involve malware or some security vuln, but they are an extra thing that people need to buy so the pathway to "everybody uses a yubikey" is a mess.

Both Android and iPhone are now offering similar functionality though phones, which mitigates the "you need to buy a new thing" problem, though it is harder to set up an effective backup here.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#122

Post by krageon »

yakubin wrote: post #120
mightybyte wrote: post #105

Earlier quoted context omitted.

Passwords, credit card numbers, social security numbers, etc are old outdated technology that can't go away fast enough. They're unfixably insecure...identifying yourself to someone by giving your secret identifying information to them immediately allows them to impersonate you! We've had the technology to fix this problem for close to 50 years now: public-key cryptography. We can't get to a password-less world fast…

I’d think SSH (indirectly: git) and TLS would be more widespread applications of public key cryptography.

TLS, yes definitely. SSH/git, no probably not - most people do not use these things.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#123

Post by flippinburgers »

denhaus wrote: post #85

Am I the only one who just cannot STAND MFA? Having to get a notification text etc. Like what if I don’t want to give an app capability to notify my phone? What if I want something totally NOT connected to my phone? I just envision a future where there is some near-circular dependency of passwords/phrases/notifications/authenticators/keys/email verifications etc across different devices and services - the end result…

You should give yubikeys a try.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#124

Post by yakubin »

krageon wrote: post #122
yakubin wrote: post #120

Earlier quoted context omitted.

I’d think SSH (indirectly: git) and TLS would be more widespread applications of public key cryptography.

TLS, yes definitely. SSH/git, no probably not - most people do not use these things.

Still more than blockchain.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#125

Post by sebk »

haspok wrote: post #109
presto8 wrote: post #73

This is a really great user experience. One thing I wonder about is if people start logging in without their password all the time, will they slowly forget what their password is over time? Partly to force memory reinforcement, I set the password cache time of gpg-agent on my machine to 24 hours maximum. Thus I have to enter my password once a day, which helps me to remember it; but it isn't overly burdensome. Althou…

My master password is "public" (I put it in a mail draft, also a note on my phone and printed it out on a piece of paper, just to be sure), and I have 2FA enabled via Yubikey. I never really understood why I had to always provide my master password anyway when logging in even on a trusted device, as the whole point of a password vault is to no longer have to remember any passwords... but we are getting there, eventua…

I'm not sure what service you're using, so this might or might not apply to you: Consider that some password managers use MFA to allow you to connect to their online service that will download a synced, encrypted copy of your password vault, but the vault itself is only wrapped with a key derived from your master password.

If someone was to obtain a copy of your vault, decrypting it would be trivial with a weak or compromised master password in that case.

CTAP supports an extension called hmac-secret that would allow you encrypt your vault, which would mitigate this issue (While introducing others potentially -- for instance, hmac-secret does not require user verification so anyone with your yubikey could decrypt it). Of course there are other mechanisms to encrypt a vault other than a key derived from a password that you can use with a Yubikey, like PGP, but I don't know of any commercial password manager that does it that way.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#126

Post by thewataccount »

teekert wrote: post #117
xoa wrote: post #20

Earlier quoted context omitted.

As well as what sibling said about it being E2EE and just using a standard API for storage, there are awesome tools these days so you can (and I think should) lock down your instance fairly well. Now when I run services like that I access them exclusively via WireGuard or Nebula, no exposure to the public internet at all. It's reliable, dependable and performant enough to pretty much put everything inside of by defau…

Do you use tricks to get https (like it can be done with Tailscale) or do you not bother anymore and rely on the transport encryption layer solely (like wireguard)? I’m in the process of moving towards putting stuff behind new vpn solutions (Tailscale/ Wireguard in my case). It does feel good to drop https though. Or does it really not matter? What do HNers think?

Preferably you want an internal CA.

The easy alternative is to purchase a domain, and use let's encrypt to create a wildcard certificate for you. I use the integration with my reverse proxy and it's pretty easy. You want a wildcard certificate because of the Certificate Transparency Logs, if you do it by subdomain then the list of registered subdomains will be public.

Certs on multiple devices - you can most likely still use let's encrypt as most things nowadays have native integration. Otherwise you'll likely have to do it manually

I recommend a domain you don't use for other things online

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#127

Post by cmdli »

lenova wrote: post #87
cmdli wrote: post #47

Earlier quoted context omitted.

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device,…

Heya! I just tried installing Bulwark on my Windows 10 machine. Install went fine, but when I try to run the app, I get the Admin privilege prompt, and then.... nothing. No sign of the program crashing, or any kind of error. Any ideas? Thanks!

Ah, that is odd. If you don't mind, could you go to %AppData%/Bulwark Passkey and taking a look at main.log or device.log and see if you see any errors in there? I would really appreciate it!

Edit: I was able to reproduce the issue; it looks like WebView2 (which Bulwark Passkey relies on) is already installed on Windows 11 but not on Windows 10. I released a new version on https://bulwark.id that has that WebView now embedded in the app itself, would you mind downloading that and seeing if that works? Thank you for the report!

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#128

Post by cmdli »

wharfjumper wrote: post #101
cmdli wrote: post #47

Earlier quoted context omitted.

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device,…

That seems interesting. What's the license? I couldn't see that in the repo [1] 1. https://github.com/bulwarkid/bulwark-passkey

My apologies; I open-sourced VirtualFIDO awhile ago but only open-sourced the actual frontend (Bulwark Passkey) about a week ago, and I forgot the license. It should be MIT licensed now.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#129

Post by cmdli »

rrgok wrote: post #113
cmdli wrote: post #55

Earlier quoted context omitted.

Yeah, trust is a big thing for me when it comes to security software, so I wanted to be upfront about what the software is good/bad against. I personally think that moving away from passwords is worth it, even if the credentials aren't stored in silicon, but I can appreciate those people who want their keys stored as securely as possible.

Admittedly I've done a little research, but every time I read about I don't understand how passkeys/fido/yubikey works. Is it guaranteed that all the services I use support passkey/yubikey/fido? If not, what should I do? Have some of services in a passkey/fido/yubikey (like yours) and the remaining in Bitwarden or other password manager? Can someone ELI5 how this works? I went to fidoalliance.org and honestly, I didn…

Passkeys are still pretty new, and only some websites support them so far, though many are adding support right now. You can take a look at https://passkeys.directory for a list of major websites that support it.

At least with Bulwark Passkey, its a separate app that you only have to log into once when you open it. Then, when logging into a website, you hit Approve on the app and it should just work. Speedwise, it should be about similar to an optimized password flow, but security-wise it will be much better since you can't phish passwords from it.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#130

Post by sneak »

Sugimot0 wrote: post #82
freeplay wrote: post #58

Earlier quoted context omitted.

Valid question. Although how could any product protect against that kind of attack? If the supply chain is compromised, it's pretty much a wrap.

That's an app store issue, but to follow up bitwarden is opensource, so you could verify the checksums and compile it yourself if you really wanted to be dead sure.

What checksums could you verify?
Post reply on HN