wols

@wols@lemm.ee

• ⁨Comment⁩ on ⁨1Password discloses security incident linked to Okta breach⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  The main difference is that 1Password requires two pieces of information for decrypting your passwords while Bitwarden requires only one.

  Requiring an additional secret in the form of a decryption key has both upsides and downsides:

  • if someone somehow gets access to your master password, they won’t be able to decrypt your passwords unless they also got access to your secret key (or one of your trusted devices)
  • a weak master password doesn’t automatically make you vulnerable

  • if you lose access to your secret key, your passwords are not recoverable
  • additional effort to properly secure your key

  So whether you want both or only password protection is a trade-off between the additional protection the key offers and the increased complexity of adequately securing it.     Your proposed scenarios of the master password being brute forced or the servers being hacked and your master password acquired when using Bitwarden are misleading.

  Brute forcing the master password is not feasible, unless it is weak (too short, common, or part of a breach). By default, Bitwarden protects against brute force attacks on the password itself using PBKDF2 with 600k iterations. Brute forcing AES-256 (to get into the vault without finding the master password) is not possible according to current knowledge.

  Your master password cannot be “acquired” if the Bitwarden servers are hacked.
  They store the (encrypted) symmetric key used to decrypt your vault as well as your vault (where all your passwords are stored), AES256-encrypted using said symmetric key.
  This symmetric key is itself AES256-encrypted using your master password (this is a simplification) before being sent to their servers.
  Neither your master password nor the symmetric key used to decrypt your password vault is recoverable from Bitwarden servers by anyone who doesn’t know your master password and by extension neither are the passwords stored in your encrypted vault.

  See bitwarden.com/…/bitwarden-security-white-paper/#o… for details.

• ⁨Comment⁩ on ⁨Spooktober meme time!⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  That number is like 20 years old.

  Today it’s around 60 billion.

• ⁨Comment⁩ on ⁨Larion Studios forum stores your passwords in unhashed plaintext.⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  It’s a big deal IMO, particularly because at login it doesn’t do the same. From the user perspective, your password has effectively been modified without your knowledge and no reasonable way of finding out. Good luck getting access to your account.
  When a bank does this it should be considered gross negligence.

• ⁨Comment⁩ on ⁨Every Single Freaking Time⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  I can’t for the life of me figure out how your proposed method helps in the described scenario.

  Maybe I misunderstood it, can you elaborate?

• ⁨Comment⁩ on ⁨The lengths we have to go to⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Yup.

  Spaces? Tabs? Don’t care, works regardless.
  Copied some code from somewhere else? No problem, 9/10 times it just works. Bonus: a smart IDE will let you quick-format the entire code to whatever style you configured at the click of a button even if it was a complete mess to begin with, as long as all the curly braces are correct.

  Also, in any decent IDE you will very rarely need to actually count curly braces, it finds the pair for you, and even lets you easily navigate between them.

  The inconsistent way that whitespace is handled across applications makes interacting with code outside your own code files incredibly finicky when your language cares so much about the layout.

  There’s an argument to be made for the simplicity of python-style indentation and for its aesthetic merits, but IMO that’s outweighed by the practical inconvenience it brings.