Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden adds support for passkeys

bitwarden.com

Post reply on HN
Print view View original

131–140 of 172 posts

Re: Bitwarden adds support for passkeys

#131

Post by lxgr »

yonixw wrote: post #39

From the FAQ [1]: > Q: Are stored passkeys included in Bitwarden imports and exports? > A: Passkeys are not included in imports and exports. I think it's the same for iCloud [2]. That is why I don't love it. I prefer a very long password, and Bitwarden "Device login" that will prompt in my iPhone that will require FaceID (So essentially I have bio login). And 2FA to lower hacking chances. I'm aware I'm still vulnerab…

> But essentially it's a certificate... so I wonder why no private key export? Maybe because current implementation uses some CA that binds you to the issuer?

It's a private key, not a certificate (at least not without using attestation).

But there is currently no portable specification of WebAuthN credentials; each authenticator is free to implement its own storage backend, and in fact some hardware authenticators deterministically re-derive the private key from an internal secret and the key handle before each signature.

Others store a randomly generated key in local storage, indexed by the key handle; yet others encrypt a randomly generated key and make that encrypted key part of the key handle.

The point being: Not all implementations can even support key imports, and there's no standardized serialization format for key exports yet.

Re: Bitwarden adds support for passkeys

#133

Post by PH95VuimJjqBqy »

giarc wrote: post #64
corytheboyd wrote: post #3

Earlier quoted context omitted.

I don’t even mind the UI honestly. It works. Some annoying UX here and there, but I can live with that. I happily pay for a subscription to support them.

My biggest peeve is that if you search for a password and you happen to be in the "Card" category for example, it will return 0 results. A good alternative would be to show No Results for the category you are in, but then provide results for other categories below.

another is that if you do a search then click on an entry and do another search, the entry details displayed and what's in the search box don't match and it's not clear unless you're paying attention.

Re: Bitwarden adds support for passkeys

#134

Post by sneak »

Axsuul wrote: post #32
deutschepost wrote: post #22

One of the nicest thing about bitwarden is the ability to selfhost it. I don't think there is anything like it. 1password seems to have the best UX in the field. But you always have to trust some company with the keys to your digital life. Self hosting password managers is not as big of a deal as it should be.

Do you get the same features self-hosting as you do paying for their cloud offering?

Yes.

Re: Bitwarden adds support for passkeys

#135

Post by charcircuit »

noman-land wrote: post #107
addicted wrote: post #106

Earlier quoted context omitted.

Any half decent sophisticated user on the internet has not remembered passwords for half a decade at least. Nearly everyone is storing it in password managers. So has that changed passwords into not being “thing you know”?

So has that changed passwords into not being “thing you know”? Yes? If you write your password down on a piece of paper it becomes something you have, no?

The server is not checking if you have a piece of paper. It is checking if you can produce a piece of information.

If someone steals your paper, copies the password to their phone, and then returns your paper, then the attacker can log in without that piece of paper. In a true "something you have" if you have that something then it is impossible for someone to login to your account.

Re: Bitwarden adds support for passkeys

#136

Post by SheinhardtWigCo »

lxgr wrote: post #124
SheinhardtWigCo wrote: post #53

Earlier quoted context omitted.

You're not really vulnerable to phishing if you use a password manager with a browser extension. Cross-platform import/export for passkeys is considered a "nice-to-have" because you can always just add a new device via other established factors (email/SMS). So, what's the point, then? Why can't passkeys just be strings that I can extract via biometric authentication? The answer: everyone pushing this has a significan…

> Why can't passkeys just be strings that I can extract via biometric authentication? As much as that lock-in annoys me personally – I could absolutely see this become a tech support scam attack vector. "Please share your passkey with us for authentication by going to your device's settings and selecting the 'export passkey' option"... > you can always just add a new device via other established factors (email/SMS) T…

> "Please share your passkey with us for authentication by going to your device's settings and selecting the 'export passkey' option"

This doesn't seem materially different from "please go to your emails and find the six-digit code we just sent you".

> Exporting a passkey leaves no relying-party-side traces.

Not if it's only useful for getting a device-bound session token. Everything you listed is already commonplace.

Re: Bitwarden adds support for passkeys

#137

Post by AnonHP »

gregorvand wrote: post #128

Pair it with mailpass.io and you have PassKeys all round, and real phishing protection than using gmail/ms/icloud emails as the communication method. Using a pw manager works well with it since the manager quickly stores the unique alias assigned to the service (ie instead of the same persistent email each time)

There's no pricing information for mailpass.io. There isn't even a contact email address or form. I'm hesitant to trust services that do not list the pricing (or future plans for pricing) transparently. Same for not having a support contact either. The help page here shows Slack as the only way to connect, but that's not convenient for people who don't use it or don't want to use it.

Re: Bitwarden adds support for passkeys

#138

Post by jesseendahl »

SheinhardtWigCo wrote: post #136
lxgr wrote: post #124

Earlier quoted context omitted.

> Why can't passkeys just be strings that I can extract via biometric authentication? As much as that lock-in annoys me personally – I could absolutely see this become a tech support scam attack vector. "Please share your passkey with us for authentication by going to your device's settings and selecting the 'export passkey' option"... > you can always just add a new device via other established factors (email/SMS) T…

> "Please share your passkey with us for authentication by going to your device's settings and selecting the 'export passkey' option" This doesn't seem materially different from "please go to your emails and find the six-digit code we just sent you". > Exporting a passkey leaves no relying-party-side traces. Not if it's only useful for getting a device-bound session token. Everything you listed is already commonplace…

>This doesn't seem materially different from "please go to your emails and find the six-digit code we just sent you".

Exactly, that's the problem lxgr is pointing out. Those six-digit codes can (and often are) phished by e.g. tech support scam attackers. lxgr is pointing out the same exact attack could be done against an exported passkey.

Re: Bitwarden adds support for passkeys

#139

Post by chrismorgan »

neurostimulant wrote: post #114
andix wrote: post #49

Earlier quoted context omitted.

In theory the Bitwarden server (and Vaultwarden) shouldn't have any access to the passwords, so a data breach of the server should never disclose any contents of the vault. Vaultwarden "feels" safe to me, but I would also be interested if there is some possibility it could introduce some degraded security compared to the official Bitwarden server. My Vaultwarden instance is "hidden" on a subdomain that probably nobod…

AFAIK if you type something in the browser's omnibar, the search provider such as google will receive the autocomplete query, so google will at least know your secret domain. If you're using letsencrypt, your subdomain will show up in the public CT log, which is probably being mined by some data or security companies. Your dns providers will also know this secret subdomain as well and and some data companies might be…

Firefox seems to be moderately conservative about what it does search autocompletion on. Type in the full URL, protocol and all, and it doesn’t look like it leaks anything after the colon.

As for CT logs, this leak is avoided by using a wildcard certificate, which Let’s Encrypt supports.

Re: Bitwarden adds support for passkeys

#140

Post by gregorvand »

AnonHP wrote: post #137
gregorvand wrote: post #128

Pair it with mailpass.io and you have PassKeys all round, and real phishing protection than using gmail/ms/icloud emails as the communication method. Using a pw manager works well with it since the manager quickly stores the unique alias assigned to the service (ie instead of the same persistent email each time)

There's no pricing information for mailpass.io. There isn't even a contact email address or form. I'm hesitant to trust services that do not list the pricing (or future plans for pricing) transparently. Same for not having a support contact either. The help page here shows Slack as the only way to connect, but that's not convenient for people who don't use it or don't want to use it.

Thanks for your points - the product is in early beta and it is fully appreciated we are asking to be trusted with inbound messages which is a higher bar than a lot of products. Pricing will be transparent and detailed soon - however the service is currently free for up to 10 services/aliases (noted on the landing page) as we determine the user cohort that gets the most value from the product in general.

We thought a Slack community was a more authentic way for users to contact / chat to those actually building the product, but please reach out to gregor@mailpass.io if you need support or just would like to ask some questions.

Post reply on HN