Bitwarden leaks passwords to other subdomains

Re:Bitwarden leaks passwords to other subdomains by davidg109 on Sunday September 20, 2020 @08:25AM (#24533604)

Sounds like a bug with autocomplete disabled, but I don’t see this as a security issue.

What is the risk with using Bitwarden in this circumstance? That I trust one server of the company but not the other and therefore a bad actor now has my creds?

[ Parent | on HN ]

Re:Bitwarden leaks passwords to other subdomains by viraptor on Sunday September 20, 2020 @08:28AM (#24533613)

Or you trust one user of a company but not another. Many services give each org a separate subdomain. If they support basic auth for whatever reason then just going to the other organisation will give them a hash of your credentials.

[ Parent | on HN ]

Re:Bitwarden leaks passwords to other subdomains by niksakl on Sunday September 20, 2020 @08:54AM (#24533728)

With basic auth you give something more than that. You give the ACTUAL credentials, because they are base64 encoded and not hashed. It is trivial to decode them and have the raw values.

To assume that a user trusts the subdomain because she trusts the domain, is something I find insane.

[ Parent | on HN ]

Re:Bitwarden leaks passwords to other subdomains by viraptor on Sunday September 20, 2020 @09:35AM (#24533941)

You're right. I was thinking of digest auth which at least has nonces and hashing. Basic does not.

[ Parent | on HN ]