[deleted]
Bitwarden Completes Third-Party Security Audit
71–80 of 148 posts
Re: Bitwarden Completes Third-Party Security Audit
#72Earlier quoted context omitted.
From your experiences is there any downside or drawbacks with switching? I've been considering it, particularly as Lastpass's Firefox app has been flakey and unreliable. In general Lastpass has become less reliable since the LogMeIn take-over, and they've now added ads to the vault which bug me from a security perspective (even if I happily pay $2/month, it is the principle of putting profits over security).
I'm a former last pass user as well. I made the switch about a year ago, and haven't really looked back. That being said, there are a few things that annoy me about bitwarden. For some sites or apps in iOS, you can launch a password manager to retrieve your credentials. This sometimes but does not always have bitwarden available. Sometimes when launching bitwarden from an app, it will only show you the logins associa…
> Sometimes when launching bitwarden from an app, it will only show you the logins associated with the URI for your current page. But if you're launching it from an app you can't search for the right login.
This changed with the recent release of iOS 12 autofill in Bitwarden. If there is no credential found based on the app/website address you have the ability to search the vault for it.
Re: Bitwarden Completes Third-Party Security Audit
#73Currently using Bitwarden right now. Really good to see that the security assessment is relatively positive: > All in all, while the client and backend code are vulnerable to some issues, all of the problems can be easily fixed without a lot of effort. In that sense, Cure53 believes these items of the Bitwarden scope to be fully capable of reaching the desired standards of security in a rather short time. To reiterat…
> Wondering how they will address the current cryptographic scheme though. The only cryptographic weakness Cure53 identified was that a malicious API server could exfiltrate encryption keys. Cure53 deemed it a hard problem to solve. I wrote a proposed strategy for mitigating it: https://github.com/bitwarden/core/issues/392 Regarding Bitwarden's cryptographic security, a cursory read through their code yields the foll…
All AES-CBC data is authenticated with HMAC SHA-256. This was highlighted in the BWN-01-011 issue (which was determined to be a false positive since it was deemed that authentication was properly done).
Re: Bitwarden Completes Third-Party Security Audit
#74I used Lastpass for about 5 years and moved to bitwarden a couple of years back. I never had to turn back again. The browser addons are great, but the mobile app is fantastic, simple, usable and lightweight. It's great to hear that it's pretty secure too.
Great browser addon? The one I'm using (the official one) could definitely use some improvements in UX and security
- when I open it my master password is prefilled and you can just unmask it - either don't prefill it and have me enter it or log me in immediately
- when creating new credentials it defaults to master password again that you can just unmask. And the URL is empty instead of the current URL
- everytime: I open a site in bitwarden, copy the username, paste in the form field in browser, open bitwarden and it's on the login page again - why can't it remember where I left of so that I could copy the password too?
EDIT: in Firefox
Re: Bitwarden Completes Third-Party Security Audit
#75Earlier quoted context omitted.
When I last tried it, it didn't support generating passwords with English words ie. A 4 work Random password: hack-flipper-jump-london. Edit: looks like it does support this now.
>When I last tried it Must have been a while back. I've used it for years and it has been able to generate word passwords since day one.
[deleted]
Re: Bitwarden Completes Third-Party Security Audit
#76Earlier quoted context omitted.
When I last tried it, it didn't support generating passwords with English words ie. A 4 work Random password: hack-flipper-jump-london. Edit: looks like it does support this now.
Not sure I understand you correctly, but Bitwarden can do this (it's the 'passphrase' option).
They recently added that:
"Oct 9 - This is in the next release for various apps." [1] the PR is from Oct 6 [2].
It is a very basic implementation as of now. The wordlist is English-only, and it doesn't have a minimum character account so it contains 'words' such as 'aa' and 'aaa'.
[1] https://community.bitwarden.com/t/add-an-ability-to-generate...
Re: Bitwarden Completes Third-Party Security Audit
#77There's a Rust implementation of the BitWarden server which is compatible with the open source clients, that you can run really easily in Docker: https://github.com/mprasil/bitwarden_rs Im running it via Dokku and it has been rock solid. It's way lighter than running their reference server implementation.
Personally, I don't recommend anyone without much knowledge in security to use "personal servers" to reduce threats. Even if it's in a private network, a server/container/whatever without recent security patches/proper configuration is no way more secure than well-managed public ones.
Re: Bitwarden Completes Third-Party Security Audit
#785-6 vulnerabilities identified but ‘no action at this time’ identified as only resolution for all of them. Worrying or is this common practice?
The audit was literally completed last week. Immediately pressing vulnerabilities were patched and shipped while plans were established for other long term fixes for the others. This report just provides disclosure of the issues.
Re: Bitwarden Completes Third-Party Security Audit
#79I've never used a password manager, I memorize them - dozens of them. And almost all of them are uniqe and "strong" passwords. Now I have a feeling that this situation is a real burden for my mind/brain and I consider using one; just trying to convince* myself. Up until this time, I was thinking that "it's a good mental exercise!", not any more. Maybe the reason is now I have too many things to ponder upon. I'd like…
I can't say I was quite as good about unique and strong passwords, but up until maybe a year ago, I just memorized all of my passwords. I had a few that I re-used a bit, especially for non-critical web sites.
Finally, I started out with LastPass. (Now I use BitWarden but the experience should be very similar.) What I knew I needed was something to work with my desktop browser, and something to work on my phone with any apps with logins, and with my mobile browser. A year ago, LastPass worked great with desktop and mobile Chrome, and Android. (BitWarden is a little trickier to integrate with mobile Firefox, as I outlined elsewhere in this thread, but it's constantly improving.)
So, you set up your new account, you choose a really amazing, unique, strong password like the world has never seen, and that's the only one you need to know. But there is that transition.
Install the password manager app and add-on(s) as needed on each place. Each will want to know your login and super amazing password, so you'll get to exercise your memory.
You probably want to go to each site and app that you infrequently use, log on in, add it to your password manager - or just do so directly, but you want to make sure the URLs and app references are correct - and move on to your everyday activities. (You can revisit later if you want to update it to something randomly generated.) Then go about your daily business, and if you get to apps and web sites you haven't added to your manager, no big deal - just let the manager remember it.
It's all really simple. Now, if you really want to do your due diligence, go back and update the password, especially for mission critical accounts, so that only your password manager knows the password, and it's as strong as possible.
Re: Bitwarden Completes Third-Party Security Audit
#80Earlier quoted context omitted.
Maybe bring that issue to Bitwarden's attention on GitHub or other channels, and not just a comment here on HN?
Cure53 just brought it to their attention, that's what this thread is about. I'm simply questioning their justification/excuses for not fixing an issue Cure53 quite correctly flagged. Me opening an issue on Github that mirrors one from Cure53's audit report wouldn't be constructive.
The report doesn't close the issue. It just provides an explanation for the current state of the issue (along with a current workaround) and details the impact of how it affects users.