Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

bitwarden.com

Post reply on HN
Print view View original

71–80 of 138 posts

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#71

Post by hedora »

phpisthebest wrote: post #45
Yujf wrote: post #28

Earlier quoted context omitted.

Better security for sure. Bitwarden is a massive target while I am not. The chance that bitwarden has a databreach is way bigger than the chance that my server gets hacked. No one cares about my server, I am nobody not worth attacking. As long as I don't leave any big holes that can be found by an untargeted attack (which I won't, I run everything behind a personal VPN) it is safer.

The entire purpose of bitwarden is they do not have your unencrypted data in the first place, so what is the fear there?

Well, based on what everyone fears is happening over at lastpass, attackers just download all the encrypted vaults, then brute force the master passwords.

I have a hard-to-guess master password, but it wouldn't surprise me if they could crack it with a 2026 vintage GPU farm.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#72

Post by Dylan16807 »

idiotsecant wrote: post #29
sam_goody wrote: post #25

Earlier quoted context omitted.

Sure. Hosting your own is a twenty minute setup, more or less, and $5/mo on Hetzner. Uptime, in my experience, is 5 nines. With SaaS, I am losing the main reason that I am using Bitwarden - that I don't want the X agency to force Bitwarden to give them my passwords. And I know that if said agency (it varies by country and target) could definitely hack the VPS if I was important enough, that is not part of my threat p…

I think if X agency wants your information the $5 wrench attack will probably bypass your self-hosted server infrastructure.

Ok.

There's a very big gap between a warrant and a torture kidnapping. Self-hosting protects a lot of that gap.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#73

Post by presto8 »

This is a really great user experience. One thing I wonder about is if people start logging in without their password all the time, will they slowly forget what their password is over time?

Partly to force memory reinforcement, I set the password cache time of gpg-agent on my machine to 24 hours maximum. Thus I have to enter my password once a day, which helps me to remember it; but it isn't overly burdensome.

Although maybe if one always has

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#74

Post by notlukesky »

cmdli wrote: post #47
syncerr wrote: post #44

Passwordless is going to be great. Though, this is just for unlocking your bitwarden account. Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If yo…

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device,…

When did you release it and how is it coming along? Is there any resistance from the physical usb crowd for FIDO?

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#75

Post by Dylan16807 »

Someone1234 wrote: post #57
Someone1234 wrote: post #4

Earlier quoted context omitted.

Because it uses Docker and that is what Docker requires.

They're literally taken from Docker's website: - https://docs.docker.com/desktop/install/linux-install/ HN has reached the point, that it will heavily downvote an objective fact because it goes against the pointed narrative. They took a dependency, copied its system requirements, and someone asks "why?" and that is the actual answer. A lot of the other answers (multiple Dockers, slimmer image) really address how Dock…

You want this page: https://docs.docker.com/engine/install/

With the requirements on here: https://docs.docker.com/engine/install/binaries/

It doesn't even mention space because it's negligible. dockerd uses a few megabytes of ram and around 100MB of drive.

Having facts doesn't always mean you're right. Sometimes it's the wrong facts.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#76

Post by joombaga »

presto8 wrote: post #73

This is a really great user experience. One thing I wonder about is if people start logging in without their password all the time, will they slowly forget what their password is over time? Partly to force memory reinforcement, I set the password cache time of gpg-agent on my machine to 24 hours maximum. Thus I have to enter my password once a day, which helps me to remember it; but it isn't overly burdensome. Althou…

That's is exactly what happened when I configured the LastPass browser extension to remember my password. I needed it to switch USB security keys and had no idea what it was. The saved password in my other browser's extension saved me.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#77

Post by cmdli »

notlukesky wrote: post #74
cmdli wrote: post #47

Earlier quoted context omitted.

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device,…

When did you release it and how is it coming along? Is there any resistance from the physical usb crowd for FIDO?

I released it a week ago. It's moving along pretty well! The USB emulation method works well, as it can support any browser. So far, I haven't gotten too much push back from the more hardcore security crowd, since I'm upfront about the fact that it is a software implementation.

Personally, I think that the main blocker for adoption of passkeys is ease of use, as if you can't transfer your credentials either off of your device or away from your Apple/Google/etc account, then I think it will be a hard sell to users.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#78

Post by mawise »

cmdli wrote: post #47
syncerr wrote: post #44

Passwordless is going to be great. Though, this is just for unlocking your bitwarden account. Real cross-device passwordless is likely coming in the next year or so. WebAuthn/Passkey is in its 3rd public working draft[1] and once finalized, we'll likely start to see it across sites. Most devices, browsers and managers have added or are adding support for it: Apple, Microsoft, Google, Auth0, Duo, 1Password, etc. If yo…

Passkeys are definitely the future, and I think will eventually eliminate a lot of phishing attempts and other insecurity caused by passwords. I'm hoping that we will eventually see transferable, secure identities that you can use to log in anywhere, rather than having to constantly create account credentials for everything. As a side note, if you want to try out passkeys now and don't want to tie it to your device,…

Good on you for offering another passkey solution! I really want more non-Google/Apple options. I'll check it out.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#79

Post by ianmcgowan »

ghostly_s wrote: post #32

Waaay at the bottom: Note: Logging in with a device is currently only available on the Bitwarden cloud server (https://vault.bitwarden.com). And even there, I followed all the directions and don't have the 'Log in with device' button. Waste of time.

I had this same experience. The fine print says you have to log in without passwordless at least once, and after that it starts working. It's a low-risk pilot of the feature I think, but will be more useful to me when it comes to the extension. It's strange that you have to sign in to the app at least once, seems to negate one of the common use cases.

The only hesitation for me is as other folks mentioned - never typing the master password again might make remembering the pass phrase challenging..

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#80

Post by dvzk »

hedora wrote: post #71
phpisthebest wrote: post #45

Earlier quoted context omitted.

The entire purpose of bitwarden is they do not have your unencrypted data in the first place, so what is the fear there?

Well, based on what everyone fears is happening over at lastpass, attackers just download all the encrypted vaults, then brute force the master passwords. I have a hard-to-guess master password, but it wouldn't surprise me if they could crack it with a 2026 vintage GPU farm.

Anyone who doubts you should run zxcvbn and more modern entropy estimators against their passwords. Our intuitions are not good. Offering password-based encryption to normal users is borderline unethical.
Post reply on HN