Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The quiet renovation at Bitwarden

blog.ppb1701.com

Post reply on HN
Print view View original

301–310 of 333 posts

Re: The quiet renovation at Bitwarden

#301

Post by _karie_ »

dpacmittal wrote: post #295
kjuulh wrote: post #205

At this point it is too high of a risk to store my password elsewhere. I've been screwed over by dashlane, lastpass, potentially bitwarden now, I am with 1password now, but I've had my passwords in all these places, and I've had to change them each time, probably missing a few. I like 1password, it is by far the highest quality product I've used in this category. I moved from BitWarden back then because their browser…

For the same reasons, I imported all my passwords to Firefox and I'm satisfied with it. I have the option to self host if I don't trust Mozilla

Any malware or LLM with user-level filesystem access can attack the outdated KDF [1] and/or wait for Firefox to be running with an unlocked credential store and read the decrypted passwords from Firefox's process memory.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=973759

Re: The quiet renovation at Bitwarden

#302

Post by RyJones »

red369 wrote: post #292
RyJones wrote: post #51

Earlier quoted context omitted.

Apple's passwords app. It's what I use almost everywhere. I use 1password for work but I'd prefer not to mix work and personal life.

I have been considering this since Apple Passwords implemented a way to export. I've just seen that the iPhone Passwords app has an export to another app you have installed on your phone, but I previously tested the export from Safari method. I realise that this is moving even more of my eggs into Apple's basket, and even further from self-reliance towards convenience, but today it doesn't seem significantly worse to…

For my Linux machines, I'm almost always coming to them via SSH or proxmox console. I started with Unix in like 85 or 86 and live on the command line when I can.

Re: The quiet renovation at Bitwarden

#303

Post by andrewaylett »

vitally3643 wrote: post #108
jillesvangurp wrote: post #84

I got my parents using bitwarden a few years ago. This was a massive improvement over them writing passwords in a little notebook in a drawer (yes, really!). But Keepass is a bridge too far for them. I'm not that enthusiastic about it myself to be honest. The UX is a bit meh (for the clients/extensions I've tried) and file syncing and handling is not something I can in good conscience push to a non technical user. It…

Passwords in a notebook are arguably the most secure option. The notebook exists in exactly one place, behind locked doors, and cannot be leaked or hacked externally. Notionally a password manager is more secure, but is there anything stopping Bitwarden from updating the app to silently send your master password up to the mothership and selling your unencrypted vault? Even supposing they stay open source and get caug…

This does depend somewhat on your risk profile. For many folk it's pretty decent: you need to guard against online attacks, so keeping your passwords offline gives them excellent security. If you need to protect yourself against family members, it's not so good — and it also doesn't provide the level of phishing protection that an online password manager offers.

Re: The quiet renovation at Bitwarden

#304

Post by akerl_ »

drzaiusx11 wrote: post #262
akerl_ wrote: post #216

Earlier quoted context omitted.

That guide is wild. By default it allows public registration, shows password hints, requires a reverse proxy for robust TLS but then passes tokens via GET params, runs in the container as root. Recommends fail2ban because it doesn't have any coverage against brute force. Recommends using a custom path for security. This feels less like a guide on hardening Vaultwarden than a guide on why I should be skeptical about i…

Requiring a reverse proxy for TLS is pretty standard, but the rest of those findings are egregious (if they haven't been addressed yet.)

The part I found jarring was that it will totally do TLS for you but using a TLS stack they don’t recommend, and if you put it behind a reverse proxy you also need to know to do custom log redaction to avoid logging tokens.

Re: The quiet renovation at Bitwarden

#305

Post by akerl_ »

harrall wrote: post #267
akerl_ wrote: post #216

Earlier quoted context omitted.

That guide is wild. By default it allows public registration, shows password hints, requires a reverse proxy for robust TLS but then passes tokens via GET params, runs in the container as root. Recommends fail2ban because it doesn't have any coverage against brute force. Recommends using a custom path for security. This feels less like a guide on hardening Vaultwarden than a guide on why I should be skeptical about i…

Those problems are endemic to all web apps. e.g. You can’t just provide software to people that obtains TLS certs on their behalf: you have no idea how their infra is setup. Hosting any app on your own infra is a serious skill set.

> Those problems are endemic to all web apps.

No, they’re not.

They’re design choices where the default that has been chosen is dangerous for somebody deploying the software. Plenty of web apps do not have those pitfalls.

Re: The quiet renovation at Bitwarden

#306

Post by jcattle »

_karie_ wrote: post #301
dpacmittal wrote: post #295

Earlier quoted context omitted.

For the same reasons, I imported all my passwords to Firefox and I'm satisfied with it. I have the option to self host if I don't trust Mozilla

Any malware or LLM with user-level filesystem access can attack the outdated KDF [1] and/or wait for Firefox to be running with an unlocked credential store and read the decrypted passwords from Firefox's process memory. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=973759

Isn't it game over anyway once you have an adversary on your system capable of reading process memory?

Re: The quiet renovation at Bitwarden

#308

Post by porshia »

noAnswer wrote: post #224
venusenvy47 wrote: post #212

Earlier quoted context omitted.

You need a VPS, correct? Are there any concerns about hardening your VPS from attackers? I worry about my ability to harden a public - facing service that is handling something so critical for myself.

Don't make it public facing! Put it behind a VPN!!

Firewall*

Re: The quiet renovation at Bitwarden

#309

Post by 306bobby »

TheCapeGreek wrote: post #287

There is one underrated feature that I switched to Bitwarden for , away from KeePass: the emergency contact access. You can designate contacts that can request access to your account. If you don't deny the request within a time frame, they are granted access. So much of our lives is now digital. Important accounts of all kinds, banking, etc. Waiting on several giant corps to grant your loved ones access after they go…

Any reason not to go with vaultwarden? It is pretty feature-parity with normal Bitwarden, up to and including the emergency access stuff

Re: The quiet renovation at Bitwarden

#310

Post by modriano »

avhception wrote: post #285
Refreeze5224 wrote: post #203

Earlier quoted context omitted.

As mentioned, enshittifying doesn't mean "make shitty" or "make worse". It's a specific exploitative company MO, like taking a product like Bitwarden and the goodwill it's generated with open source contributions, free plans, etc., and exploiting that trust by selling it to private equity, unbeknownst to the users, in order to squeeze the most out of it they can and then scrap it.

I agree with you that "enshittification" has a more specific meaning than just "make worse". Yet, the enshittification of Windows doesn't really follow the mold you described, even though I'd also call it enshittification.

MSFT is the GOAT of enshittification, and Windows is a pretty fine example of that. The OS literally comes showing you ads by default.
Post reply on HN