21–30 of 148 posts
https://github.com/mprasil/bitwarden_rs
Im running it via Dokku and it has been rock solid. It's way lighter than running their reference server implementation.
Currently using Bitwarden right now. Really good to see that the security assessment is relatively positive: > All in all, while the client and backend code are vulnerable to some issues, all of the problems can be easily fixed without a lot of effort. In that sense, Cure53 believes these items of the Bitwarden scope to be fully capable of reaching the desired standards of security in a rather short time. To reiterat…
> Wondering how they will address the current cryptographic scheme though. The only cryptographic weakness Cure53 identified was that a malicious API server could exfiltrate encryption keys. Cure53 deemed it a hard problem to solve. I wrote a proposed strategy for mitigating it: https://github.com/bitwarden/core/issues/392 Regarding Bitwarden's cryptographic security, a cursory read through their code yields the foll…
Actually data? You'd usually expect RSA to be protecting a symmetric key in this sort of setup - is that what the data is, or something else?
There's a Rust implementation of the BitWarden server which is compatible with the open source clients, that you can run really easily in Docker: https://github.com/mprasil/bitwarden_rs Im running it via Dokku and it has been rock solid. It's way lighter than running their reference server implementation.
It's been fantastic, really solid and generally pretty fast. Far, far easier than trying to get the standard Bitwarden stack going. That said, the standard stack is meant to support many users, where I have only tested the Rust implementation with a handful of users.
What are the pro/cons vs 1password?
When I last tried it, it didn't support generating passwords with English words ie. A 4 work Random password: hack-flipper-jump-london. Edit: looks like it does support this now.
Must have been a while back. I've used it for years and it has been able to generate word passwords since day one.
Can I get a quick vote on keepass2 vs bitwarden, and a feature comparison?
Personally I sync my Keepass files using a secure file sync app (not Dropbox), which is sufficient for me. I don't log into account on my phone so I don't need the passwords there, I guess it can be a reason for people to use Bitwarden.
What are the pro/cons vs 1password?
Earlier quoted context omitted.
> Wondering how they will address the current cryptographic scheme though. The only cryptographic weakness Cure53 identified was that a malicious API server could exfiltrate encryption keys. Cure53 deemed it a hard problem to solve. I wrote a proposed strategy for mitigating it: https://github.com/bitwarden/core/issues/392 Regarding Bitwarden's cryptographic security, a cursory read through their code yields the foll…
"to encrypt some data" ? Actually data? You'd usually expect RSA to be protecting a symmetric key in this sort of setup - is that what the data is, or something else?
Usually when I see RSA-OAEP in a casual stroll through something's code, I stop there and move onto looking for other issues.
Reason: Very few users of RSA encryption bother to use a secure padding mode. If they're doing that much, the chances of doing something very stupid (a.k.a. "RSA-ECB") is low enough to discount for the purposes of message board discussions.
(Obviously, if I'm being paid to review something, I spend a lot more time on it.)
When I wrote my post above, all I cared about was the modes being used. That's why I vaguely said "some data".
A further analysis (i.e. where rsaEncrypt() is invoked) yields: They're only using RSA for encrypting AES keys, which is a sane design.
Hopefully my lazy word choice didn't cause you (or anyone else) any undue alarm.