Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Completes Third-Party Security Audit

blog.bitwarden.com

Post reply on HN
Print view View original

101–110 of 148 posts

Re: Bitwarden Completes Third-Party Security Audit

#101

Post by loteck »

h1d wrote: post #94

Bitwarden has a clean interface and I like it except when you think about it, keeping your entire vault of passwords online also means, 1 single leak of your master login ID / password (which can even be something easier to remember for the sake of not forgetting, which defeats the purpose of the entire existence of it) can put an end to your online self and I stopped using anything online and having 2FA just feels t…

The same massive flaw exists with your offline password manager. The gambit of this argument is that you (or more generally the public) are more capable of properly securing and storing secrets, instead of a company of experts hired to create, configure, update and audit a service to do so.

That's a call each person can make for themselves, but if I'm advising the normals on how to handle it, there's little doubt which direction I'm pointing.

Re: Bitwarden Completes Third-Party Security Audit

#102

Post by jjoonathan »

h1d wrote: post #100
e40 wrote: post #51

Earlier quoted context omitted.

I moved from Lastpass to 1Password recently. Neither fill basic auth dialogs, and both companies state this is a feature not a bug. It still pisses me off.

This is partially because browsers don't have decent API to handle basic auth. Bitwarden will log you in via basic auth if you only have 1 matching entry for the URL but surely things can be better than this...

In the age of open source browsers that's only an excuse if they're being blocked from contributing an API.

Re: Bitwarden Completes Third-Party Security Audit

#103

Post by h1d »

I just want to mention how insanely insecure browsers' native password managers are. It asks you password only on export but never to fill on sites and you can see which sites are saved with no authentication, you just need access to the machine physically to access them all. Why do browsers never implement something as easy as lock the vault with OS account pass after a certain period after unlocking like any password managers do?

Re: Bitwarden Completes Third-Party Security Audit

#104

Post by bsharitt »

xxkylexx wrote: post #88
darkhelmet wrote: post #39

We used LastPass for several years in our home, mostly because it was able to fill Firefox http basic auth dialogs. When Firefox switched to the webextension format, LastPass started using the Chrome version as the foundation for Firefox. This was a huge step backwards and my wife HATED it. The biggest problem she had was that it was that the standard workflow of it capturing generated passwords became unreliable and…

FYI: There is also a full history of generated passwords available in each Bitwarden client app. So if you manage to lose one during the onboarding process, it should still be available in the history log.

I didn't realize that. That is very useful to know. Thanks!

Re: Bitwarden Completes Third-Party Security Audit

#105

Post by h1d »

dabeeeenster wrote: post #21

There's a Rust implementation of the BitWarden server which is compatible with the open source clients, that you can run really easily in Docker: https://github.com/mprasil/bitwarden_rs Im running it via Dokku and it has been rock solid. It's way lighter than running their reference server implementation.

For reference, the official implementation uses MSSQL, and it's asking for 2GB memory instances, so I can see people liking alternatives.

https://help.bitwarden.com/article/install-on-premise/

And there are also other third party implementations too,

Go : https://github.com/VictorNine/bitwarden-go

Ruby : https://github.com/jcs/rubywarden

Re: Bitwarden Completes Third-Party Security Audit

#107

Post by xxkylexx »

CiPHPerCoder wrote: post #97
xxkylexx wrote: post #73

Earlier quoted context omitted.

All AES-CBC data is authenticated with HMAC SHA-256. This was highlighted in the BWN-01-011 issue (which was determined to be a false positive since it was deemed that authentication was properly done).

I haven't traced through the app's code to verify that is true. Recommendation: If there is no HMAC tag with a ciphertext, immediately throw an exception. It makes it clearer that a decryption failure occurred (thus avoiding false positives).

It does do this [1], however, it is a little more complex since Bitwarden has to backwards-compat support old data that was AES-CBC encrypted from long ago before auth checks were implemented, while also combating against downgrade attacks. This same discussion was had back in January when you (I assume this is PIE Scott) reported the problem in issue 306171 on HackerOne which was closed out.

[1]: https://github.com/bitwarden/jslib/blob/master/src/services/...

Re: Bitwarden Completes Third-Party Security Audit

#108

Post by NickBusey »

h1d wrote: post #94

Bitwarden has a clean interface and I like it except when you think about it, keeping your entire vault of passwords online also means, 1 single leak of your master login ID / password (which can even be something easier to remember for the sake of not forgetting, which defeats the purpose of the entire existence of it) can put an end to your online self and I stopped using anything online and having 2FA just feels t…

2FA is only required for logins on new / unrecognized devices. If someone else had my master password, they still could not login.

I am only required to enter my 2FA on the installation of each client, so there is no really loss of convenience.

Re: Bitwarden Completes Third-Party Security Audit

#109

Post by h1d »

loteck wrote: post #101
h1d wrote: post #94

Bitwarden has a clean interface and I like it except when you think about it, keeping your entire vault of passwords online also means, 1 single leak of your master login ID / password (which can even be something easier to remember for the sake of not forgetting, which defeats the purpose of the entire existence of it) can put an end to your online self and I stopped using anything online and having 2FA just feels t…

The same massive flaw exists with your offline password manager. The gambit of this argument is that you (or more generally the public) are more capable of properly securing and storing secrets, instead of a company of experts hired to create, configure, update and audit a service to do so. That's a call each person can make for themselves, but if I'm advising the normals on how to handle it, there's little doubt whi…

I'm not talking about the security of the machine that holds the data. I'm saying any online password managers (without 2fa) can be unlocked with a single login, where offline password managers don't have such a severe problem.

Re: Bitwarden Completes Third-Party Security Audit

#110

Post by CiPHPerCoder »

xxkylexx wrote: post #107
CiPHPerCoder wrote: post #97

Earlier quoted context omitted.

I haven't traced through the app's code to verify that is true. Recommendation: If there is no HMAC tag with a ciphertext, immediately throw an exception. It makes it clearer that a decryption failure occurred (thus avoiding false positives).

It does do this [1], however, it is a little more complex since Bitwarden has to backwards-compat support old data that was AES-CBC encrypted from long ago before auth checks were implemented, while also combating against downgrade attacks. This same discussion was had back in January when you (I assume this is PIE Scott) reported the problem in issue 306171 on HackerOne which was closed out. [1]: https://github.com/…

Oh, this did seem familiar!

The AES-CBC thing is tied to the key, right? So the downgrade attack isn't possible.

Post reply on HN