Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

241–250 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#241

Post by brandon272 »

hn_throwaway_99 wrote: post #207
brandon272 wrote: post #183

Earlier quoted context omitted.

LastPass would have also led their customers to believe that "brute forcing was not possible" and that they were taking extraordinary measures to keep vaults and data safe. I think one distinction between services like KeePass and 1Password is end user perception of how easy it is for an attacker to acquire an encrypted vault to begin with. For many, they consider a KDBX database sitting in their Dropbox account to b…

Doesn't necessarily matter what LastPass "would have also led their customers to believe", the mathematical reality is still that LassPass vaults are crackable in a way that 1P vaults fundamentally are not.

Yes, according to what 1Password is telling us. But as we've seen, what these companies say and what they actually do in practice are not always aligned. And oftentimes customers are inserting a lot of their own assumptions into the mix, not only with respect to vault encryption but vault storage and operational security.

Re: Bitwarden Acquires Passwordless.dev

#242

Post by secabeen »

PassageNick wrote: post #36
xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

(Full disclosure: I work at https://passage.id ) WebAuthn is the short name for the "FIDO Alliance Web Authentication Protocol". "Passkey" is the trade name (that Apple tries to own) for the "stuff" that results from using the WebAuthn protocol. At it's root, a passkey is really the private key portion of that "stuff" that is kept. So yes, in practice, a passkey is the result of a WebAuthn implementation. MS, Apple,…

Are Passkeys exportable and re-importable by another service, site, or system?

I am strongly opposed to any authentication system that makes my authorization workflow for unrelated third-party sites dependent on any company whose terms of service allow them to suspend or terminate my use without reasonable recourse or recovery.

Passwords have problems, but I can print them out on a piece of paper in a fire safe.

Re: Bitwarden Acquires Passwordless.dev

#243

Post by cube00 »

princevegeta89 wrote: post #181
omnicognate wrote: post #61

Earlier quoted context omitted.

Vaultwarden's great. I use it. I use the Bitwarden Android client, though. Not sure what there is to replace that.

Is it not possible to point BW Android to your Vaultwarden instance?

It's fragile if you do that. Bitwarden updated their API last month on the clients so you couldn't connect to Vaultwarden at all until the Vaultwarden team could reverse engineer the change and produce a new release.

Re: Bitwarden Acquires Passwordless.dev

#244

Post by dcow »

Kimcha wrote: post #237
dcow wrote: post #213

Earlier quoted context omitted.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

Not if you are using their cloud version instead of the open source self hosted server. The code they are running does have to be the code they are publishing. And if someone compromises their cloud servers, they could also modify it to log the passwords entered.

Yes we can degenerate into inordinate amounts of rabbit holes. For 1, you can audit the JS that runs on your browser, it's not hiding (so it's not strictly fair to say that just because you loaded a webpage in your browser from their server it can't be trusted). And anyway, generally, your argument holds for any software interaction ever. GH doesn't have to ship you the repo that you browsed on the web client. A malicious actor could have compromised their infra and be serving fake code in the web UI but have added all sorts of malware to the stuff you download. Apple app store doesn't eve ship you the exact binary the developer uploaded. Scary. At some point you have to decide which threat vectors you actually care about. Give me a scenario and I can tell you how someone can theoretically attack it and why you're not safe. The only thing you can be 100% sure about is manually auditing every single release at the source level and building it yourself.

Re: Bitwarden Acquires Passwordless.dev

#245

Post by mort96 »

dcow wrote: post #213
mort96 wrote: post #155

Earlier quoted context omitted.

There's still trust there. You're writing the key to decrypt everything into their web interface if you ever use it (vault.bitwarden.com). If they wanted, they could really get access to everything in your bitwarden vault.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

I can't audit their server-side code. Even if it's open source, it's impossible to verify that the software which the server is running is identical to the open source version, or that there's no proxy in between you and the sever which logs the passwords, or some debugger attached which inspects the passwords in memory as people log in.

Re: Bitwarden Acquires Passwordless.dev

#246

Post by kevwil »

penciltwirler wrote: post #49

One can easily self host a bitwarden server on digitalocean. https://bitwarden.com/blog/digitalocean-marketplace/ However, I'm curious what y'all think about the cost. A digitalocean droplet for the recommended specs (4 GiB memory) is $24/month. This is hard to stomach when you compare with Bitwarden Premium which is <$1/month. I guess it depends on how much you value your own data.

It makes me think (dangerous, I know) ... I find it odd to use the term "self host" when referring to a third-party cloud. It's someone else's servers and network and electric bill, after all.

Pedantry aside, yeah that seems expensive given the amount of convenience offered. But much more convenient than setting up a server in your basement with a UPS and external backup drives and such.

Re: Bitwarden Acquires Passwordless.dev

#247

Post by selykg »

dddw wrote: post #200
selykg wrote: post #125

Earlier quoted context omitted.

In 1Password there's at least a half dozen ways that drag and drop could be used: - Drag a password into a password field - Drag an attachment from Finder/Explorer into an item - Drag an item from vault to vault (or collection in Bitwarden parlance) - Drag an item into a tag or folder to add that item to the folder, or add that tag to the item - Drag an app to the 1Password icon to create a software license item with…

You must be on mac, because my 1pw experience is horrible on Linux. Edit a password in the browserextention opens an new tab in n which i have to login all again. Ugh. Bitwarden at least doesn't do that. Drag and drop? Nope.

Technically it does the same thing on Mac, it opens the Mac app. But on a Mac there's universal unlock, so if you have the extension unlocked, the app will unlock, so it opens the item you want to edit in edit mode.

If you don't have the app installed it opens the website in a tab to signin and edit.

Re: Bitwarden Acquires Passwordless.dev

#248

Post by hn_throwaway_99 »

brandon272 wrote: post #241
hn_throwaway_99 wrote: post #207

Earlier quoted context omitted.

Doesn't necessarily matter what LastPass "would have also led their customers to believe", the mathematical reality is still that LassPass vaults are crackable in a way that 1P vaults fundamentally are not.

Yes, according to what 1Password is telling us. But as we've seen, what these companies say and what they actually do in practice are not always aligned. And oftentimes customers are inserting a lot of their own assumptions into the mix, not only with respect to vault encryption but vault storage and operational security.

> Yes, according to what 1Password is telling us. But as we've seen, what these companies say and what they actually do in practice are not always aligned.

That's just not accurate:

1. First off, all the encryption happens client-side. It is possible for anyone so inclined to validate how 1P and LP are doing their encryption.

2. The deficiencies in LP's encryption approach were well known for years.

My point it, yes, companies will spin things how ever they want, which is why you should completely ignore what they say and only evaluate what is verifiable. And 1P's and LP's approaches are verifiably different.

Re: Bitwarden Acquires Passwordless.dev

#249

Post by ajcoll5 »

Would have preferred to see the cash used for this to be used for things like app QoL improvements, an actual code audit (not just the basic network security assessments they list), or offer actual bounties for their bug 'bounty' program.

Re: Bitwarden Acquires Passwordless.dev

#250

Post by secabeen »

WorldMaker wrote: post #224
heresjohnny wrote: post #101

Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?

Just like TOTP (used for most 2FA) the best practice for websites accepting passkeys will be to support as many passkeys as you wish to enroll. So you could enroll into your account some device associated with your Apple ID and some device associated with your Microsoft Account and some device associated with your Google Account and some browser associated with your Firefox Account and use any of those for recovery.…

Best practice is unlikely to help here, as people just aren't going to register passkeys from multiple services unless it happens automatically. I might bother to enroll multiple passkeys for my bank, but I'm unlikely to do it often.

Are Passkeys exportable and re-importable by another service, site, or system? As described above, if my Google Account is terminated by Google without recourse (which absolutely happens), do I lose access to all sites that I used solely a Google Account Passkey for once my phone stops working?

Post reply on HN