121–130 of 148 posts
I just want to mention how insanely insecure browsers' native password managers are. It asks you password only on export but never to fill on sites and you can see which sites are saved with no authentication, you just need access to the machine physically to access them all. Why do browsers never implement something as easy as lock the vault with OS account pass after a certain period after unlocking like any passwo…
Can I get a quick vote on keepass2 vs bitwarden, and a feature comparison?
Bitwarden is closer to a LastPass competitor in the sense that it combines the encrypted database management with cloud storage, so that you can trivially share the database across devices. Keepass is only the encrypted database management component. If you want to share that database across multiple devices you have to combine it with a cloud storage service (DropBox, Google Drive, OneDrive, iCloud, etc). The major…
We used LastPass for several years in our home, mostly because it was able to fill Firefox http basic auth dialogs. When Firefox switched to the webextension format, LastPass started using the Chrome version as the foundation for Firefox. This was a huge step backwards and my wife HATED it. The biggest problem she had was that it was that the standard workflow of it capturing generated passwords became unreliable and…
Also: it has a 50% (and decreasing) success rate at actually filling in passwords and no quick menu to copy/paste them. Lastpass has been on my "replace at next opportunity" list for a while now. No time like the present.
I just want to mention how insanely insecure browsers' native password managers are. It asks you password only on export but never to fill on sites and you can see which sites are saved with no authentication, you just need access to the machine physically to access them all. Why do browsers never implement something as easy as lock the vault with OS account pass after a certain period after unlocking like any passwo…
Convenience >> security for most people, unfortunately.
I use and like Bitwarden but their iOS app feels a bit slow especially when I need to search the Vault. After tapping the search icon it takes somewhere around five seconds (sometimes even longer) of loading time until I can enter my query. Has anyone else experienced this or is it just me?
>On a less positive note, the assessment of the deployed cryptographic design led to the discovery of certain issues that must be addressed in due course. One was rated “Critical” because a malicious vault could obtain and modify organization items. This approach relied on MitM attack described in BWN-01-008. The overall code quality of the crypto implementations was deemed to be overly complex and frequently mislead…
Earlier quoted context omitted.
I moved from Lastpass to 1Password recently. Neither fill basic auth dialogs, and both companies state this is a feature not a bug. It still pisses me off.
This is partially because browsers don't have decent API to handle basic auth. Bitwarden will log you in via basic auth if you only have 1 matching entry for the URL but surely things can be better than this...
Earlier quoted context omitted.
"to encrypt some data" ? Actually data? You'd usually expect RSA to be protecting a symmetric key in this sort of setup - is that what the data is, or something else?
Yes, it's using RSA to encrypt a key, as one would hope. https://github.com/bitwarden/jslib/blob/b4fad203b94da53d3369... Usually when I see RSA-OAEP in a casual stroll through something's code, I stop there and move onto looking for other issues. Reason: Very few users of RSA encryption bother to use a secure padding mode. If they're doing that much, the chances of doing something very stupid (a.k.a. "RSA-ECB") is lo…
Thanks for replying to put my mind at ease on this.
Since Bitwarden added sub-domain support and fixed the speed-issues on large key-bases, I absolutely cannot live without Bitwarden it's been absolutely flawless. Previously used Lastpass for 8 years. So glad to see that it's security taken seriously by the developers!
>Previously used Lastpass for 8 years. As a longtime Lastpass user, this is the comment that made me go check it out. Are there any big pros or cons you have run in to compared to Lastpass (aside from the ones you listed)? I'm asking about actual functionality, not about the it being open source and such.
I just want to mention how insanely insecure browsers' native password managers are. It asks you password only on export but never to fill on sites and you can see which sites are saved with no authentication, you just need access to the machine physically to access them all. Why do browsers never implement something as easy as lock the vault with OS account pass after a certain period after unlocking like any passwo…
You must lock your workstation, it's not enough to just lock the password manager. If you leave your workstation unlocked then an attacker could install a keylogger that captures the password to unlock your password manager.