Earlier quoted context omitted.
How is the quality of browser extensions compared to Bitwarden?
You don't use a browser extension if you are serious about security anyway.
I guess I better just use same password everywhere then…
Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
361–370 of 458 posts
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#362Earlier quoted context omitted.
How is the quality of browser extensions compared to Bitwarden?
You don't use a browser extension if you are serious about security anyway.
You do use the browser extension because it's a strong anti-phishing defense.
If someone links me to "rnicrosoft.com" with a perfectly cloned login page, my eyes might not notice that it's a phishing link, but my browser extension will refuse to autofill, and that will cause me to notice.
Phishing is one of the most common attacks, and also one of the easiest to fall for, so I think using the browser extension is on-net more secure even though it does increase your attack surface some.
I know proper 2fa, like webauthn/fido/yubikeys, also solves this (though totp 2fa does not), but a lot of the sites I use do not support a security key. If all my sites supported webauthn, I think avoiding the browser extension would be defensible.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#363[dead]
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#364Earlier quoted context omitted.
I need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.
Keepass is just a single file, you can share it between devices however you want (google drive, onedrive, dropbox, nextcloud, syncthing, rsync, ftp, etc); as long as you can read and write to it, it just works. There are keepass clients for just about everything (keepassxc for desktops, keepass2android or keepassdx for android, keepassium for iphone).
That is the problem, syncing isn't the most trivial problem especially for non technical folks. User experience is far superior in a fully managed solution.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#365The issue was a compromised build pipeline that shipped a poisoned package. But PSA: If something is critical to the business and you’re using npm, pin your dependencies. I’ve had this debate with other devs throughout the years and they usually point to the lockfile as assurance, but version ranges with a ^ mean that when the lockfile gets updated, you can pull in newer versions you didn’t explicitly choose. If what…
But it goes the other way too. If there's a security vulnerability that was fixed in a later version, you want the system to automatically pick that up and apply it for you in an ideal scenario.
Even with ^ you won't get an updated version until somebody runs an install and updates the lockfile.
We have things like dependebot for this.
https://docs.github.com/en/code-security/tutorials/secure-yo...
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#366Earlier quoted context omitted.
I don't autofill. It may be less user friendly but it is not that big of a deal.
I don't save browser cookies for obvious privacy reasons and it's absolutely a big deal to not need to pull up some program and copy paste my login details constantly for every site.
I try to limit my account creation to the minimum. HN is one of the few, for the better or for the worse as sometimes I just think I should nuke it and stop wasting time commenting.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#367> Russian locale kill switch: Exits silently if system locale begins with "ru", checking Intl.DateTimeFormat().resolvedOptions().locale and environment variables LC_ALL, LC_MESSAGES, LANGUAGE, and LANG So bold and so cowards at the same time...
That isn't a smoking gun. I think it was the Vault7 leaks which showed that the NSA and CIA deliberately leave trails like this to obfuscate which nation state did it. I'm sure other state actors do this as well, and it's not a particularly "crazy" technique.
So, Russia is no longer a target for CIA?
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#368Earlier quoted context omitted.
The lack of a comprehensive standard library for JavaScript also results in projects pulling many more third party dependencies than you would with most other modern environments. It’s just a bigger attack surface. And if you can compromise a module used for basic functionality that you’d get out of the box elsewhere, the blast radius will be enormous.
So why hasn’t someone created a batteries include JS library? I don’t program in JS on the backend so I don’t know how feasible something like that is.
https://github.com/stdlib-js/stdlib was is one of several attempts at that, but yes the issue is that different people have very different views of what should be standard.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#369Earlier quoted context omitted.
The worst thing is that you can't even tell if that's "real" or just a false flag.
Does it matter? Lots of groups do such checks at startup at this point, because every news outlet who reports on it suddenly believe the group to be Russian if you do, so it's a no brainer to add today to misdirect even a little.
If walks like a duck and quacks like a duck, then it is a russian spy masqueraded like a duck. Russia is at cold war with NATO.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#370The issue was a compromised build pipeline that shipped a poisoned package. But PSA: If something is critical to the business and you’re using npm, pin your dependencies. I’ve had this debate with other devs throughout the years and they usually point to the lockfile as assurance, but version ranges with a ^ mean that when the lockfile gets updated, you can pull in newer versions you didn’t explicitly choose. If what…
This is one reason why we have lock files / version pinning