Live data from Hacker News

Bitwarden second security audit report

bitwarden.com

11–20 of 118 posts

Re: Bitwarden second security audit report

#11

Earlier quoted context omitted.

That has nothing to do with it being open source. In close-source systems I've seen penetration testers find security issues that have been present for years despite annual audits during that time. This is one of the reasons why our services get at least annual penetration testing, even the legacy ones that won't have changed since the last test. It is not a bad idea to cycle through providers too, on the off chance…

I think that was the point of the previous comment. That, despite the software being open-source and therefore more likely to have bugs spotted, and despite having a bug bounty program, the auditing company found a moderate, therefore they must be thorough.

> ...therefore they must be thorough.

I wonder if that's the case here. I don't work in that space but the issues they found seem like they might be low hanging fruit. I've pasted them below for anyone that's curious.

> The Cross Origin Resource Sharing (CORS) configuration on Bitwarden server APIs allows for any clientorigin to access its endpoints.

> The Content Security Policy (CSP) configuration on the Bitwarden web vault application allows for'unsafe-inline' CSS styles to execute.

Re: Bitwarden second security audit report

#12
What does it cost to hire somebody reputable to perform an audit like this? Its something I want to look into for one of my own projects, but I have no frame of reference for what is a reasonable price for a simple full stack app (way simpler than bitwarden for sure)

Re: Bitwarden second security audit report

#17

Tangential question: What password manager do you guys use?

Bitwarden. Works well and the integration with 2FA/TOTP is amazing. I highly recommend to not rely on a single (mobile) device for 2FA. Loosing or breaking it might shut you out of certain accounts forever.

Re: Bitwarden second security audit report

#18

What does it cost to hire somebody reputable to perform an audit like this? Its something I want to look into for one of my own projects, but I have no frame of reference for what is a reasonable price for a simple full stack app (way simpler than bitwarden for sure)

Unfortunately, it varies wildly. Some firms can perform fully automated remote scans for a few hundred $$$ and it can move all the way up to 100+ page reports with manual pen testing for literally hundreds of thousands of dollars.

What you want or need will fit somewhere in between.

Post reply on HN