Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

bitwarden.com

Post reply on HN
Print view View original

101–110 of 138 posts

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#101

Post by wharfjumper »

cmdli wrote: post #47
syncerr wrote: post #44

Passwordless is going to be great. Though, this is just for unlocking your bitwarden account. Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If yo…

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device,…

That seems interesting. What's the license? I couldn't see that in the repo [1]

1. https://github.com/bulwarkid/bulwark-passkey

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#102

Post by dankwizard »

aewens wrote: post #92
martin_a wrote: post #90

Earlier quoted context omitted.

> MFA using an SMS is not secure. Why not? Is it that easy to intercept a SMS or is that just due to poor handling with some providers?

No the parent, but I’m assuming they’re referring to the East of SIM spoofing to convince providers you’re another phone number that’s not your own.

More commonly referred to as Sim Swapping.

If you ever notice you lose connection to your carrier: begin to worry.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#103

Post by U1F984 »

rwky wrote: post #100

Hopefully you can turn this off. I've seen cases where attackers enter an email address and just keep spamming the login form until the owner accepts the notification. Obviously 2fa would help here but not everyone uses that.

The option is only available for known devices, which should make it more difficult to pull this off.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#104

Post by SahAssar »

pabs3 wrote: post #93
cmdli wrote: post #47

Earlier quoted context omitted.

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device,…

Apparently it is possible to make WebAuthn phishable: https://mjg59.dreamwidth.org/62175.html https://news.ycombinator.com/item?id=33810984

That's only for sites acting as a oauth2 authorization server, right?

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#105

Post by mightybyte »

denhaus wrote: post #85

Am I the only one who just cannot STAND MFA? Having to get a notification text etc. Like what if I don’t want to give an app capability to notify my phone? What if I want something totally NOT connected to my phone? I just envision a future where there is some near-circular dependency of passwords/phrases/notifications/authenticators/keys/email verifications etc across different devices and services - the end result…

Passwords, credit card numbers, social security numbers, etc are old outdated technology that can't go away fast enough. They're unfixably insecure...identifying yourself to someone by giving your secret identifying information to them immediately allows them to impersonate you! We've had the technology to fix this problem for close to 50 years now: public-key cryptography. We can't get to a password-less world fast enough IMO.

I know a lot of HN doesn't have much use for blockchain, but if there's one thing that blockchain has done for the world it's been to substantially spur the use and development of public-key auth systems, especially on the UX front. This is because it had no choice. If you try to use an inherently broken password auth system for completely decentralized digital currency, it will immediately descend into unusable chaos because of the vulnerability. Traditional finance (credit cards), government identification systems (social security), etc have so much existing infrastructure that innovating in this area is hugely costly and slow, but it's absolutely the direction we need to go.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#106

Post by haspok »

rwky wrote: post #100

Hopefully you can turn this off. I've seen cases where attackers enter an email address and just keep spamming the login form until the owner accepts the notification. Obviously 2fa would help here but not everyone uses that.

This option is turned off by default, as mentioned in the blogpost.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#107

Post by SturgeonsLaw »

martin_a wrote: post #90
Tidal5474 wrote: post #89

Earlier quoted context omitted.

MFA is not going away, but neither is it going to become what you are describing. MFA using an SMS is not secure. If people reliably made good passwords and never reused them, we probably wouldn't need MFA as much. Unfortunately, we live in a society. Bitwarden will remember your TOTP codes for you across any device you login from. It will even copy the code to you paste buffer during a login. I enable MFA everywhere…

> MFA using an SMS is not secure. Why not? Is it that easy to intercept a SMS or is that just due to poor handling with some providers?

Yep it is that easy, often all it takes is a suitably phrased "please give me control of this phone number" in a telco's support live chat

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#108

Post by jmcnulty »

dvzk wrote: post #63
phpisthebest wrote: post #45

Earlier quoted context omitted.

The entire purpose of bitwarden is they do not have your unencrypted data in the first place, so what is the fear there?

The Bitwarden webvault infrastructure is a doomsday target. If it's compromised, no evidence of a client backdoor will exist except in the server logs. You can't avoid using it, because you need to sign into the webvault to configure 2FA. Want to change the encryption passphrase? Guess what, you need to use the webvault. Bitwarden's vault encryption is essentially reduced to the security model of TLS.

And? If you don't trust TLS then I assume you don't trust web banking, or purchasing anything over the internet for that matter. Might as well give up on technology and go find yourself a nice quiet pastoral life.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#109

Post by haspok »

presto8 wrote: post #73

This is a really great user experience. One thing I wonder about is if people start logging in without their password all the time, will they slowly forget what their password is over time? Partly to force memory reinforcement, I set the password cache time of gpg-agent on my machine to 24 hours maximum. Thus I have to enter my password once a day, which helps me to remember it; but it isn't overly burdensome. Althou…

My master password is "public" (I put it in a mail draft, also a note on my phone and printed it out on a piece of paper, just to be sure), and I have 2FA enabled via Yubikey. I never really understood why I had to always provide my master password anyway when logging in even on a trusted device, as the whole point of a password vault is to no longer have to remember any passwords... but we are getting there, eventually.
Post reply on HN