News for hackers. Stuff that matters.

A comment on Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password. Parent comment

Re:Passwordless Authentication – Access Your Bitwarden Web V... by hedora on Monday December 05, 2022 @10:47PM (#33875664)
Well, based on what everyone fears is happening over at lastpass, attackers just download all the encrypted vaults, then brute force the master passwords.

I have a hard-to-guess master password, but it wouldn't surprise me if they could crack it with a 2026 vintage GPU farm.

[ Parent | on HN ]
Re:Passwordless Authentication – Access Your Bitwarden Web V... by dvzk on Tuesday December 06, 2022 @12:07AM (#33876155)
Anyone who doubts you should run zxcvbn and more modern entropy estimators against their passwords. Our intuitions are not good. Offering password-based encryption to normal users is borderline unethical.
[ Parent | on HN ]