Live data from Hacker News

Bitwarden Completes Third-Party Security Audit

blog.bitwarden.com

11–20 of 148 posts

Re: Bitwarden Completes Third-Party Security Audit

#11
post #7

Since Bitwarden added sub-domain support and fixed the speed-issues on large key-bases, I absolutely cannot live without Bitwarden it's been absolutely flawless. Previously used Lastpass for 8 years. So glad to see that it's security taken seriously by the developers!

>Previously used Lastpass for 8 years.

As a longtime Lastpass user, this is the comment that made me go check it out. Are there any big pros or cons you have run in to compared to Lastpass (aside from the ones you listed)? I'm asking about actual functionality, not about the it being open source and such.

Re: Bitwarden Completes Third-Party Security Audit

#13
post #6

Currently using Bitwarden right now. Really good to see that the security assessment is relatively positive: > All in all, while the client and backend code are vulnerable to some issues, all of the problems can be easily fixed without a lot of effort. In that sense, Cure53 believes these items of the Bitwarden scope to be fully capable of reaching the desired standards of security in a rather short time. To reiterat…

> Wondering how they will address the current cryptographic scheme though.

The only cryptographic weakness Cure53 identified was that a malicious API server could exfiltrate encryption keys.

Cure53 deemed it a hard problem to solve. I wrote a proposed strategy for mitigating it: https://github.com/bitwarden/core/issues/392

Regarding Bitwarden's cryptographic security, a cursory read through their code yields the following:

* It's using RSA-OAEP to encrypt AES keys (EDIT: formerly "some data") https://github.com/bitwarden/jslib/blob/b4fad203b94da53d3369...

* It's using AES-256-CBC https://github.com/bitwarden/jslib/blob/b4fad203b94da53d3369... + https://github.com/bitwarden/jslib/blob/b4fad203b94da53d3369... + https://github.com/bitwarden/jslib/blob/2045e7047a66599b2c8a...

It doesn't appear to be authenticating the AES-CBC-encrypted ciphertexts in all cases, which makes me suspect padding oracles are still in-scope.

https://robertheaton.com/2013/07/29/padding-oracle-attack/

RSA-OAEP is the better RSA mode. (You don't want PKCS1v1.5)

In closing: As long as you're not for some reason storing unauthenticated AES-CBC ciphertexts in the server, the encryption is really boring.

(Boring is good for encryption.)

Re: Bitwarden Completes Third-Party Security Audit

#15
post #12

What are the pro/cons vs 1password?

When I last tried it, it didn't support generating passwords with English words ie. A 4 work Random password: hack-flipper-jump-london. Edit: looks like it does support this now.

Not sure I understand you correctly, but Bitwarden can do this (it's the 'passphrase' option).

Re: Bitwarden Completes Third-Party Security Audit

#16
I have been using Keepass2, then KeepassXC for 5 years, with Dropbox to sync the db between my devices.

Since Dropbox recently stopped to support ecryptfs, I started looking for alternatives (KeepassXC + Google Drive/SpiderOak, Lastpass were some candidates).

Looks like Bitwarden is worth testing too :-)

Re: Bitwarden Completes Third-Party Security Audit

#17
post #7

Since Bitwarden added sub-domain support and fixed the speed-issues on large key-bases, I absolutely cannot live without Bitwarden it's been absolutely flawless. Previously used Lastpass for 8 years. So glad to see that it's security taken seriously by the developers!

>Previously used Lastpass for 8 years. As a longtime Lastpass user, this is the comment that made me go check it out. Are there any big pros or cons you have run in to compared to Lastpass (aside from the ones you listed)? I'm asking about actual functionality, not about the it being open source and such.

I used LastPass for roughly a year before making the switch. I also switched from Chrome to Firefox at the same time, on Windows and Android. Desktop - no issues!

Android is evolving, and their changes seem to have put Firefox in a slightly behind position, which I think they're almost caught up on. Basically, there's legacy and modern autofill capabilities in Android, and Firefox is working on closing the gap. In the production release, I am unable to use the BitWarden android app, but there's an add-on that mostly does the job.

I have two issues with the add-on. First, it tends to disappear from the menu. There have been some bugs on BugZilla for this, including one I recently submitted. Of course, quite fortunately, I haven't been able to reproduce the issue since I submitted the bug and installed Nightly. And it's interesting - Nightly seems to work with the app, so the need for the add-on should go away. Second, the add-on is a little clunky. It opens a temporary tab, and then closes that tab when you select your login. However, there's an issue there, too, where sometimes it just does not work. It throws up an error message that it's unable to autofill, and there's little you can do about it except close the temporary tab and the original tab, and start again.

The Android app also has an issue that I've seen with Chrome, where it isn't actually detecting the site you're browsing, but just the app you're using (Chrome) and thus is unable to select your login. This is easy to get around - usually going back to Chrome and then tapping the BitWarden toast will find you your login.

Overall little nuisances that are mostly Android related issues more than anything, and each of them seems to be getting worked out, so I expect the user experience to only get better.

Re: Bitwarden Completes Third-Party Security Audit

#18
post #7

Since Bitwarden added sub-domain support and fixed the speed-issues on large key-bases, I absolutely cannot live without Bitwarden it's been absolutely flawless. Previously used Lastpass for 8 years. So glad to see that it's security taken seriously by the developers!

How is the form fill for information besides username and password (e.g. credit cards, personal contact info) compared to LastPass?

Re: Bitwarden Completes Third-Party Security Audit

#19
post #4

isn't there still a lot more hardening things to do, like moving payment out from vault.bitwarden.com, so that this domain can have a stronger CSP policy? In other news: my todo list now features an item to migrate lastpass -> bitwarden. (I really love the effort here)

I mostly don't regret switching from LastPass to BitWarden. Migration of logins was pretty painless. My only issue is with Android/Firefox. (Desktop Firefox + BitWarden is excellent!) The current Firefox doesn't play well with the Android BitWarden app, so you have to use the Add-on. (At least, this has been my experience.) I've also frequently encountered an issue where the menu item in Firefox for BitWarden vanishe…

My only problem was ampersands. LastPass encoded them as & and I wasn't aware of this at first. After receiving errors for some passwords, I found out that was the problem. I had to find and replace all. Bitwarden was aware of this though, they have a warning for this on their migration guide.

Re: Bitwarden Completes Third-Party Security Audit

#20

I have been using Keepass2, then KeepassXC for 5 years, with Dropbox to sync the db between my devices. Since Dropbox recently stopped to support ecryptfs, I started looking for alternatives (KeepassXC + Google Drive/SpiderOak, Lastpass were some candidates). Looks like Bitwarden is worth testing too :-)

I use keepass and syncthing for the passt 4 years. This is peer to peer syncing which means at least two of the devices have to be on. I solved that by having a raspi always on which distributes the newest file if I don’t have laptop or phone connected at the same time
Post reply on HN