171–180 of 284 posts
I used to use Bitwarden with this feature though, just that I recently came to the conclusion that the product probably isn't the most secure offering and it has some issues on Android with native autofill when you aren't using Google Services.
Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…
Of course the PIN can be brute forced. It feels like reporting "I can walk over the lawn fence". That PIN is probably here to prevent your kids from messing with your vault when you grab your coffee with your computer unlocked. Protecting from an attacker with your laptop locked should be done at the OS level with FDE and secure boot. Protecting from a real attacker with access to your unlocked computer is a bit hope…
Secure boot also doesn't matter because the boot time root kits are a rarity and trojaned downloaded SW (npm, homebrew, etc. nearly completely unprotected from malicious actors beyond the bare minimum) or the massive browser attack surface are what are actually used.
What would be nice is proper layered sandboxing at the OS level, always on, but obviously the kernel-userland ABI is not actually very secure in practice, and has been the source of recurring escapes. But at least it would be something.
Consider this: as it is, sophisticated users on, say, the MacOS platform, who download SW such as homebrew, youtube-dl, whatever, or do local development with npm and other package managers, are actually in a much worse place than unsophisticated users who run with "only from the app store" enabled.
This is not a good place to be.
Earlier quoted context omitted.
I agree with the mindset and that's why I think it's good the data is still encrypted even if, as the author mentioned, they might as well have left the data in plaintext. Sure entering a passphrase each time is better for security. But if the user chooses to set up a PIN instead, I feel the current behavior is reasonable.
If it is not the default behavior then I agree with you.
Earlier quoted context omitted.
I'm not sure what qualifies as "lacking" but fingerprint unlock is definitely a thing in Linux. I set it up on my IBM laptop over a decade ago. These days, the interface even appears to have improved somewhat, to the point where there's nice GUIs and everything. https://help.ubuntu.com/stable/ubuntu-help/session-fingerpri... Also, dongle support is pretty good for things like java PIV cards and yubikeys. I've success…
Fingerprints work great in modern Linux distros (I use them for sudo and sometimes unlocking my display), but the fingerprint hardware and the TPM don't seem to talk to each other. Windows Hello (and I presume TouchID) is set up to handle authentication and authorization together in one well-secured kernel blob with all kinds of TPM trickery to ensure security. The Linux version of this process, at least as far as I…
As for eliminating passwords, while I love the idea of hardware dongles, I'm always going to want to have a password on it.. I assume you mean eliminating having a ton of passwords as opposed to one good strong password on the dongle. But then, that's the same situation I'm in with the password managers anyway. It's not like I actually type my password into most websites anymore...
After the attacks and smear campaigns, shall the people unwilling to use KeyPass and other high-lift/high-risk pieces of software move on to using tiered password strategies for their hundreds of sites again?
"Bitwarden does not warn about this risk." This is wrong. The Bitwarden client very clearly warns about storing your encryption key locally via a mandatory popup window, as seen here: https://i.imgur.com/BzXJmos.png
"Bitwarden does not warn about this risk." This is wrong. The Bitwarden client very clearly warns about storing your encryption key locally via a mandatory popup window, as seen here: https://i.imgur.com/BzXJmos.png
That's about as unclear as I could imagine. "If you use this option please ensure you take the appropriate precautions."
Glad I transitioned my passwords from Bitwarden to an offline password manager that doesn't have a similar "easy PIN password mode" feature. I used to use Bitwarden with this feature though, just that I recently came to the conclusion that the product probably isn't the most secure offering and it has some issues on Android with native autofill when you aren't using Google Services.
Earlier quoted context omitted.
Fingerprints work great in modern Linux distros (I use them for sudo and sometimes unlocking my display), but the fingerprint hardware and the TPM don't seem to talk to each other. Windows Hello (and I presume TouchID) is set up to handle authentication and authorization together in one well-secured kernel blob with all kinds of TPM trickery to ensure security. The Linux version of this process, at least as far as I…
I had no particular desire to use TPM thus far, but you're right, searching briefly on this, it seems the tcscd daemon written by IBM provided by the "trousers" project does not seem to have any PAM integration. That said, presumably you could plug the 2 together (pam and tcscd) with some random script, right? Sure, that doesn't avoid the brute force scenario, but if it's just to store some ridiculously long random k…
What I mean is eliminating passwords on most services at all. For everything but real important stuff (banks, email, business accounts, that kind of stuff), I reckon my devices are protected enough that if someone can gain access to my devices unlocked enough, 2FA wouldn't prevent any threads anyway. Passwords are easy to brute force, but device-bound keys aren't.
Using the security chips inside my devices for authentication as a single factor is more than enough for most of my purposes. Today, most websites offer FIDO2/WebAuthn/U2F as a second factor, but I'd rather see them as a first factor with an optional password as a second factor.
My password manager protects me against nothing more than brute forcing and password reuse. Switching to TPM-first moves the protected bastion from a piece of software running in userland to either a kernel level-protected component or a dedicated piece of hardware. There's only so much you can do as a desktop application to protect your users' keys, after all.
I wouldn't want to force anyone into this system, but I do think with the hype FIDO2 was released with, I imagine browsers are going to push more for using FIDO2 as a primary factor where available.