Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Completes Third-Party Security Audit

blog.bitwarden.com

Post reply on HN
Print view View original

91–100 of 148 posts

Re: Bitwarden Completes Third-Party Security Audit

#91

Post by toyg »

greythree wrote: post #87
neogodless wrote: post #17

Earlier quoted context omitted.

I used LastPass for roughly a year before making the switch. I also switched from Chrome to Firefox at the same time, on Windows and Android. Desktop - no issues! Android is evolving, and their changes seem to have put Firefox in a slightly behind position, which I think they're almost caught up on. Basically, there's legacy and modern autofill capabilities in Android, and Firefox is working on closing the gap. In th…

In Firefox, you can also open Bitwarden in a sidebar (which doesn't disappear thankfully).

Can you ? How? I don't see any option.

Re: Bitwarden Completes Third-Party Security Audit

#93

Post by HaHa31 »

I just want to pop in and say that I am planning on moving from lastpass to bitwarden. I have significant problems with the lastpass android app, the biggest being my CORRECT password being rejected; also the app is just really buggy in general. I hope bitwarden is an improvement.

Re: Bitwarden Completes Third-Party Security Audit

#94

Post by h1d »

Bitwarden has a clean interface and I like it except when you think about it, keeping your entire vault of passwords online also means, 1 single leak of your master login ID / password (which can even be something easier to remember for the sake of not forgetting, which defeats the purpose of the entire existence of it) can put an end to your online self and I stopped using anything online and having 2FA just feels the convenience has flew out the window just to login to some site and offline password managers can just work fine without that massive flaw.

Re: Bitwarden Completes Third-Party Security Audit

#95

Post by txcwpalpha »

yread wrote: post #74
pcx wrote: post #29

I used Lastpass for about 5 years and moved to bitwarden a couple of years back. I never had to turn back again. The browser addons are great, but the mobile app is fantastic, simple, usable and lightweight. It's great to hear that it's pretty secure too.

Great browser addon? The one I'm using (the official one) could definitely use some improvements in UX and security - when I open it my master password is prefilled and you can just unmask it - either don't prefill it and have me enter it or log me in immediately - when creating new credentials it defaults to master password again that you can just unmask. And the URL is empty instead of the current URL - everytime:…

Regarding your first two points, this is a long shot but maybe it will help: I had a very similar problem with LastPass where password fields in the LastPass UI kept being pre-filled with my master password, even in places where there seemingly should never be pre-filled. It turned out that I had accidentally enabled my web browser's autofill/password manager functionality, and every time I visited the LastPass extension's internal URL, my browser was autofilling every password field with the password that my browser saved.

Once I turned off the password manager feature of my browser (I didn't need it anyway since I was using LastPass) it solved the problem.

Re: Bitwarden Completes Third-Party Security Audit

#96

Post by CiPHPerCoder »

rocqua wrote: post #84
CiPHPerCoder wrote: post #13

Earlier quoted context omitted.

> Wondering how they will address the current cryptographic scheme though. The only cryptographic weakness Cure53 identified was that a malicious API server could exfiltrate encryption keys. Cure53 deemed it a hard problem to solve. I wrote a proposed strategy for mitigating it: https://github.com/bitwarden/core/issues/392 Regarding Bitwarden's cryptographic security, a cursory read through their code yields the foll…

Last I heard on RSA-OAEP vs RSA-PKCS is that, since RSA-PKCS got a 'security proof' it is actually favored. Reason being that it gives similar guarantees but is easier to compute. I don't know the details of the security proof for RSA-PKCS though, just that there is one.

You're thinking signatures, not encryption.

https://paragonie.com/blog/2018/04/protecting-rsa-based-prot...

Re: Bitwarden Completes Third-Party Security Audit

#97

Post by CiPHPerCoder »

xxkylexx wrote: post #73
CiPHPerCoder wrote: post #13

Earlier quoted context omitted.

> Wondering how they will address the current cryptographic scheme though. The only cryptographic weakness Cure53 identified was that a malicious API server could exfiltrate encryption keys. Cure53 deemed it a hard problem to solve. I wrote a proposed strategy for mitigating it: https://github.com/bitwarden/core/issues/392 Regarding Bitwarden's cryptographic security, a cursory read through their code yields the foll…

All AES-CBC data is authenticated with HMAC SHA-256. This was highlighted in the BWN-01-011 issue (which was determined to be a false positive since it was deemed that authentication was properly done).

I haven't traced through the app's code to verify that is true.

Recommendation: If there is no HMAC tag with a ciphertext, immediately throw an exception. It makes it clearer that a decryption failure occurred (thus avoiding false positives).

Re: Bitwarden Completes Third-Party Security Audit

#98

Post by btgeekboy »

occamrazor wrote: post #92

I use Safari on macOS and iOS. with its native password manager.Am I exposing myself to higher risks than by using a standalone password management app?

They’re probably ok, but you’re locking yourself in/out should you ever want/need to use a non-Apple device.

Re: Bitwarden Completes Third-Party Security Audit

#99

Post by jjoonathan »

darkhelmet wrote: post #39

We used LastPass for several years in our home, mostly because it was able to fill Firefox http basic auth dialogs. When Firefox switched to the webextension format, LastPass started using the Chrome version as the foundation for Firefox. This was a huge step backwards and my wife HATED it. The biggest problem she had was that it was that the standard workflow of it capturing generated passwords became unreliable and…

Also: it has a 50% (and decreasing) success rate at actually filling in passwords and no quick menu to copy/paste them.

Lastpass has been on my "replace at next opportunity" list for a while now. No time like the present.

Re: Bitwarden Completes Third-Party Security Audit

#100

Post by h1d »

e40 wrote: post #51
darkhelmet wrote: post #39

We used LastPass for several years in our home, mostly because it was able to fill Firefox http basic auth dialogs. When Firefox switched to the webextension format, LastPass started using the Chrome version as the foundation for Firefox. This was a huge step backwards and my wife HATED it. The biggest problem she had was that it was that the standard workflow of it capturing generated passwords became unreliable and…

I moved from Lastpass to 1Password recently. Neither fill basic auth dialogs, and both companies state this is a feature not a bug. It still pisses me off.

This is partially because browsers don't have decent API to handle basic auth. Bitwarden will log you in via basic auth if you only have 1 matching entry for the URL but surely things can be better than this...
Post reply on HN