201–210 of 210 posts
Earlier quoted context omitted.
Bitwarden migration was flawless for me. Impressive given how mangled the csv export i got from lastpass was! I really dig the 2FA auto-copy to clipboard feature in bitwarden.
> the 2FA auto-copy to clipboard feature in bitwarden is that if you're using bitwarden's 2FA authenticator instead of e.g. authy?
Earlier quoted context omitted.
> if you have apple devices Does it work if you have apple devices and also non-apple devices?
Of course it doesn't, that's not how Apple operate.
Earlier quoted context omitted.
The official bit warden self host runs something like 13 docker containers. Good luck securing that as a normal person
There is a beta test of a new all in one container option as of earlier this month: https://bitwarden.com/blog/new-deployment-option-for-self-ho...
Earlier quoted context omitted.
there's a non-zero risk of hosting it yourself and not keeping up with the maintenance/security updates of whatever server you host it on. gotta weigh that in the calculus. It might not be likely that they target you specifically but there could be a drive by bot that slurps up your password vault.
Most people seem to think it needs to be accessible online. Remote Access =/= Internet Access. Self hosting an external vault, using VPNs, and requiring MFA access make the vault tricky to get to in the first place. You’re machine would need to be compromised first for an attacker to even connect to it—and at that point you’re compromised (and probably keylogged). If you’re actively under attack no Password Manager,…
ok but that also is prone to a weakness in any part of that chain assuming you even set it up properly in the first place. each piece is another layer that can be hacked or improperly setup.
Earlier quoted context omitted.
> the 2FA auto-copy to clipboard feature in bitwarden is that if you're using bitwarden's 2FA authenticator instead of e.g. authy?
Correct. It auto copies the code if the TOTP secret key has been set for that item.
edit: A rep called right away. They will not give me my money back. It's in their terms and conditions that they won't even if there is a security breach and it's been longer than 30 days since I paid.
[1]: https://support.lastpass.com/help/iknow-my-masterpassword-ho...
Earlier quoted context omitted.
Think about it for a moment. Which is more likely to be compromised: A widely advertised central location storing thousands of peoples’ passwords, or a single user’s passwords on their local computer accessed through an app which doesn’t even access the internet?
Providing that the vault is fully encrypted/unencrypted locally, in what way is it going to be compromised? If someone wants to avoid having their vault in a LastPass/1Password/… cloud for some reason, it’s also possible to sync the vault through general use cloud solutions like Mega/Dropbox/…
An obvious way to attack typical cloud password managers is via their web apps, which is an endpoint attack and hence bypasses the encryption. This type of attack is much harder for native, offline password managers.
Earlier quoted context omitted.
>Your password manager should be offline, not a cloud service. Why?
There's this persistent vague myth on HN that there's something terrible about having an encrypted blob publicly exposed, which to me demonstrates a total lack of understanding about cryptography. Or they're just using weak passwords. Don't do that. The problem here is that a bunch of unencrypted data was exposed, which is really bad and dumb of LastPass.
Exploiting bugs in the end-user web application, accidentally exposing unencrypted data, unnecessarily collecting all data in a single location in the first place, a break in cryptography leading to a total break of security are all failure modes that only affect cloud password managers.