News for hackers. Stuff that matters.

A comment on Backdoored password manager stole data from as many as 29K enterprises. Parent comment

Re:Backdoored password manager stole data from as many as 29... by antaviana on Sunday April 25, 2021 @05:08AM (#26931373)
Bitwarden says they are hashed and encrypted with your email and master key before leaving your device so it is not possible to get them even if they are ever hacked.

So far so good, but how do they protect from hacking or from Bitwarden employees the shared secrets in an organization? I understand that each member of the organization team has their own master key.

[ Parent | on HN ]
Re:Backdoored password manager stole data from as many as 29... by ivanhoe on Sunday April 25, 2021 @06:14AM (#26931613)
> Bitwarden says they are hashed and encrypted with your email and master key before leaving your device so it is not possible to get them even if they are ever hacked.

This part makes electron apps even a bigger problem, because if hacker owns the app that's the point where they can grab the password before it's encrypted.

[ Parent | on HN ]