Ask HN: Anyone else Bitwarden account being attacked • Hacker News Board

firstlink wrote: post #9

CommitSyn wrote: post #5

Earlier quoted context omitted.

What additional vectors? If they already had the data, would they be using the web account login page?

E.g. PITM attack on password reset endpoints. And yes, if I had a bitwarden vault I wanted to crack I'd absolutely be using the web account login page. The latter is more likely to yield to have some vulnerability than the at-rest encryption, which when exploited would yield the password; or it could scare the target into falling into my PITM attack, or otherwise act irrationally.

PITM?

What type of vulnerability could the web interface have that the offline password file wouldn't? Unless they have a backdoor. The speed difference would also be tens or millions of times faster.

Re: Ask HN: Anyone else Bitwarden account being attacked

#15

Post by BOOSTERHIDROGEN » Tue, Jun 13, 2023, 4:17 AM UTC

Is this within bitwarden server or on your self hosting server ?

Re: Ask HN: Anyone else Bitwarden account being attacked

#16

Post by ThePowerOfFuet » Tue, Jun 13, 2023, 2:45 PM UTC

nytesky wrote: post #6

adr1an wrote: post #2

I don't use that service. Do you have two-factor authentication? If not, you should really consider using it. The 2fa is a major security upgrade for any account.

I had problems with their 2FA where the code would come via SMS but be rejected. I was able to recover via email but it was distressing. Do they have OTP service now?

Why use SMS 2FA?

Re: Ask HN: Anyone else Bitwarden account being attacked

#17

Post by thedangler » Tue, Jun 13, 2023, 4:08 PM UTC

I reset my password from the app not the web service. I also do not have my username in bitwarden only the passwords.

Re: Ask HN: Anyone else Bitwarden account being attacked

#18

Post by eswat » Tue, Jun 13, 2023, 6:02 PM UTC

Never got this.

Depending on your threat model, I suggest using a unique email address to register your password manager account. Harden that email account and set up email forwards if it's separate or just give the password manager a unique name for your catch-all email address (I believe iCloud offers something similar to this as well).