News for hackers. Stuff that matters.

A comment on Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password. Parent comment

Re:Passwordless Authentication – Access Your Bitwarden Web V... by dvzk on Monday December 05, 2022 @09:48PM (#33875271)
The Bitwarden webvault infrastructure is a doomsday target. If it's compromised, no evidence of a client backdoor will exist except in the server logs. You can't avoid using it, because you need to sign into the webvault to configure 2FA. Want to change the encryption passphrase? Guess what, you need to use the webvault. Bitwarden's vault encryption is essentially reduced to the security model of TLS.
[ Parent | on HN ]
Re:Passwordless Authentication – Access Your Bitwarden Web V... by jmcnulty on Tuesday December 06, 2022 @04:51AM (#33877593)
And? If you don't trust TLS then I assume you don't trust web banking, or purchasing anything over the internet for that matter. Might as well give up on technology and go find yourself a nice quiet pastoral life.
[ Parent | on HN ]
Re:Passwordless Authentication – Access Your Bitwarden Web V... by dvzk on Tuesday December 06, 2022 @05:36AM (#33877836)
I trust the cryptography behind TLS. I don’t trust every website using TLS. The difference between end-to-end encryption and transport-layer encryption is the website operator can recover the plaintext. I’m glad that you think E2EE is a waste of effort though.
[ Parent | on HN ]
Re:Passwordless Authentication – Access Your Bitwarden Web V... by dvzk on Tuesday December 06, 2022 @05:48AM (#33877913)
Following up, I find it funny that this old meme comment thought orders and banking are our most trusted activities, and not our communications and data storage.
[ Parent | on HN ]
Re:Passwordless Authentication – Access Your Bitwarden Web V... by hackerman123469 on Thursday December 08, 2022 @07:50AM (#33907309)
For me personally, I don't actually trust any of that.

Any purchase I do online is done with a virtual card that links to a bank account that only ever has the amount I need to pay for whatever it is I am currently purchasing. That way it doesn't matter if the information is stolen etc. because there is no more money to use and I can cancel the card as easily as I can create a new.

For banking I also only use my banks official app, I don't know how exactly it works and I assume it does use some form of http and whatnot, but I wouldn't trust using a bank through the browser as you never know what kind of thing an extension or something have in there.

[ Parent | on HN ]