Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Completes Third-Party Security Audit

blog.bitwarden.com

Post reply on HN
Print view View original

111–120 of 148 posts

Re: Bitwarden Completes Third-Party Security Audit

#111

Post by vezycash »

darkhelmet wrote: post #39

We used LastPass for several years in our home, mostly because it was able to fill Firefox http basic auth dialogs. When Firefox switched to the webextension format, LastPass started using the Chrome version as the foundation for Firefox. This was a huge step backwards and my wife HATED it. The biggest problem she had was that it was that the standard workflow of it capturing generated passwords became unreliable and…

>When Firefox switched to the webextension format, LastPass started using the Chrome version as the foundation for Firefox.

The backward change started after logmein bought lastpass.

Re: Bitwarden Completes Third-Party Security Audit

#112

Post by xxkylexx »

CiPHPerCoder wrote: post #110
xxkylexx wrote: post #107

Earlier quoted context omitted.

It does do this [1], however, it is a little more complex since Bitwarden has to backwards-compat support old data that was AES-CBC encrypted from long ago before auth checks were implemented, while also combating against downgrade attacks. This same discussion was had back in January when you (I assume this is PIE Scott) reported the problem in issue 306171 on HackerOne which was closed out. [1]: https://github.com/…

Oh, this did seem familiar! The AES-CBC thing is tied to the key, right? So the downgrade attack isn't possible.

Yes, new account keys are identified (presence of a mac key) and block the downgrade (see code link above).

Re: Bitwarden Completes Third-Party Security Audit

#113

Post by geekamongus »

xxkylexx wrote: post #88
darkhelmet wrote: post #39

We used LastPass for several years in our home, mostly because it was able to fill Firefox http basic auth dialogs. When Firefox switched to the webextension format, LastPass started using the Chrome version as the foundation for Firefox. This was a huge step backwards and my wife HATED it. The biggest problem she had was that it was that the standard workflow of it capturing generated passwords became unreliable and…

FYI: There is also a full history of generated passwords available in each Bitwarden client app. So if you manage to lose one during the onboarding process, it should still be available in the history log.

This is true of Lastpass, too. Just click the down arrow next to the generate pw field.

Re: Bitwarden Completes Third-Party Security Audit

#114

Post by chrismorgan »

dabeeeenster wrote: post #21

There's a Rust implementation of the BitWarden server which is compatible with the open source clients, that you can run really easily in Docker: https://github.com/mprasil/bitwarden_rs Im running it via Dokku and it has been rock solid. It's way lighter than running their reference server implementation.

Six months or so ago, I switched from KeePassX with manual file synchronisation, to using bitwarden_rs on my own server, which runs Arch Linux, via a package on AUR. I haven’t had any trouble with it so far. The current version has been running for almost a month, and its resident memory is currently just over 11MB, viz. low and stable. That’s also roughly the size of the package and its data on disk.

I do also have the optional web interface, which isn’t Rust; it uses inordinately much memory while building (https://github.com/bitwarden/web/issues/250) but is fine after that.

Re: Bitwarden Completes Third-Party Security Audit

#115

Post by yread »

txcwpalpha wrote: post #95
yread wrote: post #74

Earlier quoted context omitted.

Great browser addon? The one I'm using (the official one) could definitely use some improvements in UX and security - when I open it my master password is prefilled and you can just unmask it - either don't prefill it and have me enter it or log me in immediately - when creating new credentials it defaults to master password again that you can just unmask. And the URL is empty instead of the current URL - everytime:…

Regarding your first two points, this is a long shot but maybe it will help: I had a very similar problem with LastPass where password fields in the LastPass UI kept being pre-filled with my master password, even in places where there seemingly should never be pre-filled. It turned out that I had accidentally enabled my web browser's autofill/password manager functionality, and every time I visited the LastPass exten…

Hah that did it. I'm sorry for criticizing BitWarden when it was my own fault

Re: Bitwarden Completes Third-Party Security Audit

#116

Post by h1d »

jjoonathan wrote: post #102
h1d wrote: post #100

Earlier quoted context omitted.

This is partially because browsers don't have decent API to handle basic auth. Bitwarden will log you in via basic auth if you only have 1 matching entry for the URL but surely things can be better than this...

In the age of open source browsers that's only an excuse if they're being blocked from contributing an API.

Are you suggesting password manager devs start sending patches to browsers? Getting used to all browser API isn't exactly easy to begin with, let alone there aren't many who has enough motivation to wait for that implementation to become wide spread for it to finally solve a problem that is only used by a few.

Re: Bitwarden Completes Third-Party Security Audit

#117

Post by spurgu »

tilolebo wrote: post #16

I have been using Keepass2, then KeepassXC for 5 years, with Dropbox to sync the db between my devices. Since Dropbox recently stopped to support ecryptfs, I started looking for alternatives (KeepassXC + Google Drive/SpiderOak, Lastpass were some candidates). Looks like Bitwarden is worth testing too :-)

I've used Keepass since 2012 (Keepass2 on Linux, KeepassXC on Mac, Keepass2Android) synced with Dropbox but (experimentally) switched to Bitwarden this summer as a reaction to some HN thread, I've been very pleased! Haven't used it on Linux yet but am using the Chrome extension on Mac and the native Android & iOS apps and they work very well.

I've also been using Lastpass at work since 2015 so have experience of those three and if I had to start over and pick one it would definitely be Bitwarden. Highly recommended!

Re: Bitwarden Completes Third-Party Security Audit

#119

Post by echanfsw »

>On a less positive note, the assessment of the deployed cryptographic design led to the discovery of certain issues that must be addressed in due course. One was rated “Critical” because a malicious vault could obtain and modify organization items. This approach relied on MitM attack described in BWN-01-008. The overall code quality of the crypto implementations was deemed to be overly complex and frequently misleading, which led to reporting a false positive issue (see BWN-01-011). More generally, cryptographic libraries of the Bitwarden compound have not yet been optimized. They particularly need to be simplified as unnecessary complexity can lead to problems.

>To reiterate, the results of this autumn 2018 assessment are positive for the client and code. Sadly, the same thing cannot be stated for the current cryptographic scheme in use. Given the number and range of issues discovered, it seems necessary that a re-design takes place. This needs to reassess how certain features are implemented and ensure that the overall cryptography stands strong against the attackers’ efforts.

Um. Is this not worrying to people?

Post reply on HN