Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden adds support for passkeys

bitwarden.com

Post reply on HN
Print view View original

111–120 of 172 posts

Re: Bitwarden adds support for passkeys

#111

Post by lxgr »

drdaeman wrote: post #95
jwally wrote: post #94

I'm missing something. Webauthn puts a private key into a firewalled section of hardware onto your device - which is extremely prickly to work with in my experience - for your security. For passkeys to be transferable the private key cannot be locked to your device. Is bitwarden somehow able to "spoof" this hardware and have your browser generate private keys in it instead?

> Webauthn puts a private key into a firewalled section of hardware This is not true. In general, Webauthn doesn’t care where and how the keys are stored. There is attestation feature, but AFAIK e.g. Apple intentionally doesn’t implement it for unmanaged devices.

Not sure about managed vs. unmanaged devices, but Apple used to support attestation before they started synchronizing passkeys via iCloud.

Re: Bitwarden adds support for passkeys

#112

Post by lolinder »

barkerja wrote: post #110
wkat4242 wrote: post #71

Earlier quoted context omitted.

The idea of passkeys is that they can be synced so you don't lose them when you lose a device. So there's a lot less need to have two

Multiple passkeys backed by different sources (password manager, iCloud, Yubikey, etc.) can serve as a backup in the case you lost access to your password manager, for example. If a service provides the option for more than one passkey, I always configure several.

But that doesn't explain why you'd want multiple keys all in the same password manager. That seems to miss the point of the redundancy, like keeping an "offsite" backup onsite.

Re: Bitwarden adds support for passkeys

#113

Post by Bu9818 »

ClassyJacket wrote: post #79
artdigital wrote: post #62

Earlier quoted context omitted.

You’re not really “trusting a company with the keys to your digital life”. The vault is encrypted with a password that never gets transmitted, and even if your password and vault gets stolen, without the additional “secret key” that also never leaves your device (and you should probably print and store somewhere safe), an attacker won’t be able to do much with it. The inclusion of an additional secret key makes a hug…

But you have to trust them that the secret key never gets transmitted, unless you compiled it yourself.

Also, malicious code can be pushed to the website if you are logging in through that. You have to trust that their infrastructure is safe.

Re: Bitwarden adds support for passkeys

#114

Post by neurostimulant »

andix wrote: post #49
aborsy wrote: post #28

Does the code in Vaultwarden mimic the code in the self hosted version of Bitwarden? Or a code audit in Bitwarden has no bearing on vaultwarden?

In theory the Bitwarden server (and Vaultwarden) shouldn't have any access to the passwords, so a data breach of the server should never disclose any contents of the vault. Vaultwarden "feels" safe to me, but I would also be interested if there is some possibility it could introduce some degraded security compared to the official Bitwarden server. My Vaultwarden instance is "hidden" on a subdomain that probably nobod…

AFAIK if you type something in the browser's omnibar, the search provider such as google will receive the autocomplete query, so google will at least know your secret domain. If you're using letsencrypt, your subdomain will show up in the public CT log, which is probably being mined by some data or security companies. Your dns providers will also know this secret subdomain as well and and some data companies might be able to obtain them.

Re: Bitwarden adds support for passkeys

#115

Post by lxgr »

jwally wrote: post #101
drdaeman wrote: post #95

Earlier quoted context omitted.

> Webauthn puts a private key into a firewalled section of hardware This is not true. In general, Webauthn doesn’t care where and how the keys are stored. There is attestation feature, but AFAIK e.g. Apple intentionally doesn’t implement it for unmanaged devices.

I've experienced this on my phone IIRC...if I register a webauthn key on chrome on iphone, it shows up on safari; but the reverse is not true. Im assuming this is because apple uses a software based TPM that isn't tied to the device. This lets those private keys sync between devices. Is the future state for bitwarden to be able to perform the same trick somehow? Have you create keys in it and not your devices tpm?

The situation with Chrome and Apple devices is currently quite confusing.

Apple has only recently introduced the necessary APIs to allow for third-party passkey providers (i.e. other apps acting as a passkey storage) and users (i.e. other apps using passkeys stored in iCloud and in other third-party provider apps).

But it's not easy as passkeys being supported on the latest versions; at least Google used to support a non-synchronizing platform authenticator implementation of WebAuthN using the system keychain and Touch ID (or the login password as a fallback) as well. So there is also a chance you were using that, at least on macOS.

> Is the future state for bitwarden to be able to perform the same trick somehow?

For web browsers, I believe the current approach of 1Password and presumably also Bitwarden is to inject a custom implementation of WebAuthN into every page's context. This doesn't require any WebAuthN/passkey support on the browser's side.

On macOS, they could also act as a system-level passkey provider though; this should then allow all passkey consumers (such as Safari and other browsers) to use these passkeys natively, i.e. without a JavaScript shim. And on iOS, given how web extensions are notoriously tricky there and all browsers are kind of Safari under the hood anyway, that might even be the only option.

Re: Bitwarden adds support for passkeys

#116

Post by lxgr »

quaffapint wrote: post #26

So it's browser extension only? I can't use the android app to login with a passkey I stored from my desktop browser? Hopefully they'll add that support soon enough, because password access on my mobile is a big pain point.

From the website:

> Passkeys support for mobile applications is planned for a future release.

Re: Bitwarden adds support for passkeys

#117

Post by lxgr »

Spunkie wrote: post #15

One of the benefits we saw moving from lastpass to bitwarden is it allow us to much more easily reduce duplicate entries for the same site/account. So it's pretty annoying to see in the docs for this passkey feature that they just expect you to make a duplicate bitwarden entry for every additional passkey you need to add to an account. Especially when it's standard to register a backup key for any service that uses p…

I can see the point of having multiple passkeys (e.g. backed by different passkey managers, like 1Password in addition to Bitwarden, or a combination of physical security keys and passkeys), as well as the point of being able to store multiple passkeys for different accounts in a single Bitwarden profile (e.g. for work and personal Google accounts).

But when would anyone need multiple passkeys for the same site account in the same Bitwarden vault?

Re: Bitwarden adds support for passkeys

#118

Post by Spivak »

unethical_ban wrote: post #102
jerf wrote: post #91

Earlier quoted context omitted.

It comes from the fact there are three fundamental ways to authenticate: a thing you know, a thing you have, a thing you are. You may not "know" a passkey or a TOTP token, but you are using computers in their most fundamental role as bicycles for the mind to "know" them for you. This means they still fit into "thing you know". Clearly a TOTP token is not a thing you are. Less clearly, it is not a thing you have. Pass…

Yep. Thing you have is a passkey that can't be copied at all, like a yuibikey, some physical manifestation that can't be easily cloned. Arguably TOTP is "have" due to being linked to a phone when doing push to a single device.

TOTP is just PAKE with a funny way of writing the password.

We tricked people into using actually secure passwords and password managers by calling it 2FA and devising a scheme where the human does the challenge and the server necessarily must keep that part of the password in plaintext, but in exchange the user doesn't have to type out the long part of the password every time.

Re: Bitwarden adds support for passkeys

#119

Post by snailmailman »

cmurf wrote: post #100

iOS inhibits solving the cross platform problem, due to lack of browser extensions for all browsers. I get to use iOS built-in password manager, sync only on Apple devices and then no where else; or I get to use Bitwarden everywhere but on iOS no browser integration, I have to copy and paste (separately) user and password. Or even more lovely, maintain separate managers.

Third party apps can integrate with iOS’s native password autofill, just like how keychain works. Bitwarden supports this as well. I’ve been using Bitwarden seamlessly on all my devices, iOS included, for a while now. It works in apps other than safari too. Anywhere where the native iOS password manager would appear, my Bitwarden passwords appear as well.

I don’t think apps can turn on autofill automatically, you might have to manually turn it on in Settings->Passwords->Password Options

Re: Bitwarden adds support for passkeys

#120

Post by lxgr »

jorvi wrote: post #87
barbazoo wrote: post #8

Earlier quoted context omitted.

Can you compare to 1Password?

1Password is very trustworthy too. They get audited frequently, and their db file format is open source (meaning you can write a 3rd party tool to decrypt them). With UI/UX they are lightyears ahead of Bitwarden. I want to like Bitwarden, but when your application doesn’t even support extremely basic stuff like drag ‘n drop, I’m gone. In general they also support newer tech much faster. And their secret key system is…

> With UI/UX they are lightyears ahead of Bitwarden.

1Password is arguably moving backwards these days, UI-wise.

I don't know if it's caused by the Electron update or just coincided with it, but I've been finding the keyboard autofill shortcut as well as keyboard navigation for selecting a given login on a page very unreliable lately.

That said, 1Password's "auto-rotate password" feature is still ahead of the competition, though. Bitwarden doesn't even seem to try, but that's still better than LastPass, which reliably used to lock me out by irrevocably overwriting the old stored password before the website confirms the new one as having been accepted.

> their secret key system is more secure than Bitwarden’s password-only method.

I don't know, their security key mechanism seems to be getting weakened in the interest of convenience as well. I was recently very surprised to notice that the iOS client apparently synchronizes the security key for any logged-in vault to iCloud Keychain, with no way to opt out – even for enterprise vaults!

Bitwarden will also soon support the WebAuthN/CTAP2 "PRF" extension, which is even better than a static security key since it rotates with every vault unlock.

Post reply on HN