News for hackers. Stuff that matters.

A comment on Bitwarden Design Flaw. Parent comment

Re:Bitwarden Design Flaw by sircastor on Monday January 23, 2023 @10:48PM (#34498938)
I upped mine to more than 1M and haven’t seen any degradation of performance.
[ Parent | on HN ]
Re:Bitwarden Design Flaw by vena on Monday January 23, 2023 @11:25PM (#34499247)
did you fully log out/in or just lock/unlock?

iirc locking with BW doesn’t do what one might expect wrt encryption state.

[ Parent | on HN ]
Re:Bitwarden Design Flaw by ywain on Monday January 23, 2023 @11:26PM (#34499256)
Changing the number of iterations should automatically log you out on all devices. At least it did for me.
[ Parent | on HN ]
Re:Bitwarden Design Flaw by vena on Monday January 23, 2023 @11:38PM (#34499347)
oh good, didn’t know if it would do that/force a cache invalidation for clients
[ Parent | on HN ]
Re:Bitwarden Design Flaw by sircastor on Monday January 23, 2023 @11:36PM (#34499333)
It forced me out of all my logged in instances. I had to login to everything. With my master password and my 2nd factor.
[ Parent | on HN ]
Re:Bitwarden Design Flaw by orra on Tuesday January 24, 2023 @09:33AM (#34504024)
That's important to realise, in case your (normal) second factor is a different Bitwarden device!
[ Parent | on HN ]
Re:Bitwarden Design Flaw by sircastor on Tuesday January 24, 2023 @12:49PM (#34507179)
I didn't even think about this. My 2nd factor is through a different app, but if I'd been using BitWarden's TOTP I wonder if I would've been stuck.

A good reminder to also have printed (or something) OTPs accessible in a safe place in case you need them.

[ Parent | on HN ]
Re:Bitwarden Design Flaw by runnerup on Tuesday January 24, 2023 @12:22AM (#34499700)
The max allowed value appears to be 2 million iterations, and that still seems very very snappy on my original M1 MacBook Air.
[ Parent | on HN ]