Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

351–360 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#351

Post by Biganon »

obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

"I don't want my encrypted passwords on Bitwarden's servers. I'm OK with having my encrypted passwords on Apple's servers."

Re: Bitwarden Acquires Passwordless.dev

#352

Post by temeritatis »

Jack5500 wrote: post #5

Slightly offtopic, but I really find the Bitwarden Clients to be lacking in the feature department. I switched to Bitwarden a few month ago and the client has evolved (for me) ever since. There are a few basic features missing, such as that if I search for something I wrote in the notes of password, that the client shows the according password. I get that the open-source model implies that everyone can contribute and…

> There are a few basic features missing, such as that if I search for something I wrote in the notes of password, that the client shows the according password

It might be that your search term is a partial of a word. This is fine when searching some fields, but for finding entries with that word in the notes section, the search term needs wildcards. You can read more about it here: https://bitwarden.com/help/searching-vault/

But to paraphrase: "notes: Item's notes. Only full-word matches will be listed unless you use wildcards."

Hope it helps.

Re: Bitwarden Acquires Passwordless.dev

#353

Post by StreamBright »

8organicbits wrote: post #210
StreamBright wrote: post #71

I am not sure how much is this better than magic link logins.

Magic links via email? Email isn't a secure transport, or storage. I think that's only viable for low risk systems. Even software like Slack, which supports magic links via email, will also support username/password/MFA as an option for folks who need better security.

Depends on the implementation. Most email servers use TLS and strong authentication, but I understand there are email providers without those.

Re: Bitwarden Acquires Passwordless.dev

#354

Post by hn92726819 »

Biganon wrote: post #351
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

"I don't want my encrypted passwords on Bitwarden's servers. I'm OK with having my encrypted passwords on Apple's servers."

Difference, of course, being that keepass kdbx is offline and not dependent on any particular online service.

If apple gets too greedy with iCloud, you can sync your kdbx with 1000 other clients.

Re: Bitwarden Acquires Passwordless.dev

#355

Post by hn92726819 »

dcow wrote: post #244
Kimcha wrote: post #237

Earlier quoted context omitted.

Not if you are using their cloud version instead of the open source self hosted server. The code they are running does have to be the code they are publishing. And if someone compromises their cloud servers, they could also modify it to log the passwords entered.

Yes we can degenerate into inordinate amounts of rabbit holes. For 1, you can audit the JS that runs on your browser, it's not hiding (so it's not strictly fair to say that just because you loaded a webpage in your browser from their server it can't be trusted). And anyway, generally, your argument holds for any software interaction ever. GH doesn't have to ship you the repo that you browsed on the web client. A mali…

If you run keepass in a cgroup with no networking (or blocking in/outbound traffic in windows firewall) or extra disk access, your attack vector shrinks considerably. That's not particularly difficult to do, while it is to audit js on every single bitwarden page load

Re: Bitwarden Acquires Passwordless.dev

#356

Post by shantnutiwari »

Jack5500 wrote: post #5

Slightly offtopic, but I really find the Bitwarden Clients to be lacking in the feature department. I switched to Bitwarden a few month ago and the client has evolved (for me) ever since. There are a few basic features missing, such as that if I search for something I wrote in the notes of password, that the client shows the according password. I get that the open-source model implies that everyone can contribute and…

yeah, for me the Bitwarden iphone app doesnt support Touchid, which means I have to enter my password everytime.

1Password does, and is much easier to use (though I use both)

Re: Bitwarden Acquires Passwordless.dev

#357

Post by tracker1 »

Kimcha wrote: post #237
dcow wrote: post #213

Earlier quoted context omitted.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

Not if you are using their cloud version instead of the open source self hosted server. The code they are running does have to be the code they are publishing. And if someone compromises their cloud servers, they could also modify it to log the passwords entered.

Then host your own.

Re: Bitwarden Acquires Passwordless.dev

#358

Post by PassageNick »

_8j50 wrote: post #283
PassageNick wrote: post #126

Earlier quoted context omitted.

The threat surface of a password based system is like Lake Superior. The threat surface of a passkey based solution is like a small puddle after a rain. How is there a "reduction" in security here?

Doesn't work that way. Passwords are inferior but still a strong layer of defense. You are putting all your eggs in one basket again. The lesson from passwords is that a single factor of authentication is inherently inferior to multiple factors of authentication. From a threat actor's perspective, even a yubikey is a matter of one well planned attack (physical, compromised host,etc) and by nature newer factors of aut…

Passwordless is MFA -- something you are and something you have.

I'm not a yubikey expert, but I don't believe that losing your Yubikey will open up your company to a breach.

For a typical passwordless solution, losing your phone isn't a risk, given that no one can reproduce your face or thumbprint.

Re: Bitwarden Acquires Passwordless.dev

#359

Post by BrandoElFollito »

cube00 wrote: post #316
BrandoElFollito wrote: post #269

Earlier quoted context omitted.

This is interesting. I use BW daily (many times) on Android against my self-updating VW instance. I did not notice anything, maybe the break happened during the night in Europe. Or the Android app did not want about problems.

In my case I could continue to use the app, it broke the ability to sign into the vault. If you only lock your vault and not fully logout you may not have noticed it. https://github.com/dani-garcia/vaultwarden/issues/3082

Thanks. I do not even lock BW, not to mention logging out, and almost never connect to the vault via the web interface - so yes I must have simply missed it.

Re: Bitwarden Acquires Passwordless.dev

#360

Post by PassageNick »

secabeen wrote: post #271
PassageNick wrote: post #266

Earlier quoted context omitted.

You own your own passkeys on your own device, ultimately. Google/Apple/MS have no ownership or knowledge of the actual keys.

Okay, can they block access to those keys and/or the the backups of them? Assume that my account is terminated or that it's compromised to the degree that I cannot re-claim access to it. Can I move those keys to my new device/system without the cooperation of Google/Apple/MS?

They cannot block access. The passkeys are actually stored on your devices in a Trusted Platform Module. When moved to the cloud, they are E2E encrypted, and the transferring platform has zero knowledge of your keys.

Currently, you cannot move them to other devices without the cooperation of some cloud service, or the like. At some point you'll have to trust someone to move passkeys between devices.

Post reply on HN