Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

Re:Bitwarden_rs: Unofficial Bitwarden compatible server writ... by sneak on Thursday March 18, 2021 @09:58AM (#26502731)

Note also that the bitwarden desktop app has a remote code execution vulnerability that the developers refuse to fix, which means that the developers can, at any time, replace your local copy of the bitwarden desktop app with a different version that could steal all your passwords in exactly the manner you describe.

You can patch the bitwarden client (and also take the opportunity to remove the spyware they have embedded in it, as well), or use a program like LuLu or Little Snitch to block it from communicating with anything but your own selfhosted bitwarden_rs instance.

[ Parent | on HN ]

Re:Bitwarden_rs: Unofficial Bitwarden compatible server writ... by dastx on Thursday March 18, 2021 @09:00PM (#26509230)

Do you have more information on this? A link maybe?

EDIT: Never mind, found it - https://github.com/bitwarden/desktop/issues/552. This isn't exactly an RCE. You can say the same about anything. By your logic Microsoft auto-updates are RCE. Same with pacman/apt-get/yum package managers. Same with pretty much anything else.

I'm not saying they're not valid concerns, however, if you're this worried about all of these things, maybe cloud-based software isn't for you.

[ Parent | on HN ]