Bitwarden releases “emergency access” feature
bitwarden.com
Bitwarden releases “emergency access” feature
1–10 of 154 posts
Re: Bitwarden releases “emergency access” feature
#2Here's the details on how it works:
Re: Bitwarden releases “emergency access” feature
#3Nice! I was already satisfied using Bitwarden, and now I will no longer have to manually manage my ICE backup.
In the past I've kept an offline copy of my 'vault' on a few USB keys in a safe deposit, for my family in case of death or similar. I'm curious how others have solved this problem.
Re: Bitwarden releases “emergency access” feature
#4Nice! I was already satisfied using Bitwarden, and now I will no longer have to manually manage my ICE backup. In the past I've kept an offline copy of my 'vault' on a few USB keys in a safe deposit, for my family in case of death or similar. I'm curious how others have solved this problem.
I have a similar and opposite problem. I would be fine with all my secrets dying with me, but what i want to protect against is me going into a coma/for some reason I forget how to access my accounts.
How to securely manage it so that only I can open it if my biological self is there? I don't trust bank safe deposit boxes and I can't put a safe worth using inside my Apt.
https://www.nytimes.com/2019/07/19/business/safe-deposit-box...
Re: Bitwarden releases “emergency access” feature
#5> On confirmation, the grantor’s Master Key is encrypted using the grantee’s public key and stored once encrypted. Grantee is notified of confirmation.
> When the request is approved or the wait time lapses, the public-key-encrypted Master Key is delivered to grantee for decryption with grantee’s private key.
I'm not quite sure how I feel about the way they're doing this. Whilst this is a feature a lot of people desire, the way that they're doing it makes it feel like it would be impossible to verify that they're not storing your Master Key, or transmitting it to someone else - i.e. backdoor.
At least, not with the level of detail I can find. [0]
Re: Bitwarden releases “emergency access” feature
#6Am I reading it right that this allows people to designate access to their password manager via email? I feel like I have to missing something, like a previous step that fingerprints the emergency contact's key or something.
(I get that we rely on email for stuff like this all the time, but your password manager is part of what protects your email account, which is why we rely on email as much as we do for resets).
Re: Bitwarden releases “emergency access” feature
#7Nice! I was already satisfied using Bitwarden, and now I will no longer have to manually manage my ICE backup. In the past I've kept an offline copy of my 'vault' on a few USB keys in a safe deposit, for my family in case of death or similar. I'm curious how others have solved this problem.
I periodically send my loved ones encrypted copies of my password vault. A copy of the decryption key is stored in my safe-deposit box, which they can access only after I am gone. This lets me update the contents of my password vault without having to visit the bank.
And actually, the safe-deposit box only holds one half of the decryption key. My loved ones have the other half in their respective safe-storage locations. This means a rogue bank employee can’t drill my box and do anything useful with the contents.
The password vault itself is a plaintext file that I decrypt and edit/grep as needed. I use the OpenSSL command-line tool for encryption and decryption. My loved ones either have this installed by default on MacOS, or have a Cygwin installation on Windows with which I have tested the commands. The safe-deposit box contains short and detailed instructions for use for my non-technical loved ones.
I also use the Google Chrome password manager with client-side encryption enabled. Whenever I change any important passwords, I’ll export its contents to my text file password vault.
Re: Bitwarden releases “emergency access” feature
#8> On confirmation, the grantor’s Master Key is encrypted using the grantee’s public key and stored once encrypted. Grantee is notified of confirmation. > When the request is approved or the wait time lapses, the public-key-encrypted Master Key is delivered to grantee for decryption with grantee’s private key. I'm not quite sure how I feel about the way they're doing this. Whilst this is a feature a lot of people desi…
I'm under the impression that the "encrypt master key with the receiver's public key" step is done on-client, so you could verify that the master key isn't being stored the same way you can very they're not sending the master key when logging into the web ui: looking at devtools and seeing everything that leaves the network.
Re: Bitwarden releases “emergency access” feature
#9This represents a dramatic escalation of side-channel attack vectors and surface area. It’s an unfortunate inevitability that this will not end well. Secure platforms never provide affordances for backdoors, especially backdoors tightly coupled to externalities. Bitwarden is further attracting unnecessary attention to itself from actors who have an interest in the collection of the volunteered emergency-trust relationships. Bitwarden would be well-advised to reconsider this feature.
Re: Bitwarden releases “emergency access” feature
#10Nice! I was already satisfied using Bitwarden, and now I will no longer have to manually manage my ICE backup. In the past I've kept an offline copy of my 'vault' on a few USB keys in a safe deposit, for my family in case of death or similar. I'm curious how others have solved this problem.
I have a similar and opposite problem. I would be fine with all my secrets dying with me, but what i want to protect against is me going into a coma/for some reason I forget how to access my accounts. How to securely manage it so that only I can open it if my biological self is there? I don't trust bank safe deposit boxes and I can't put a safe worth using inside my Apt. https://www.nytimes.com/2019/07/19/business/sa…
Perhaps just an old ipnone or android with a fingerprint sensor and another installation of bitwarden. You can keep the phone's passcode written down because its only use is to start the device. Then configure biometric log-in for bitwarden as an alternative to a distinct passphrase. In the event of a total blank, you should still have access as long as you retain a finger.