Re:Bitwarden Design Flaw
by pricechild on Tuesday January 24, 2023 @05:47AM
(#34502015)
OWASP seem to recommend that number. e.g. https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
Re:Bitwarden Design Flaw
by ThreePinkApples on Tuesday January 24, 2023 @05:48AM
(#34502027)
The current (and very recently updated) OWASP recommendation[1] is a minimum of 600 000 iterations
[1] https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
I read that as a "total of 600 000" iterations, so 300 000 locally and 300 000 on the server. Am I wrong?
According to the OP article, the server side iterations are ineffective for adding security in bitwarden, so you need 600,000 on the client. This would not be the case if the design was correct.
(I'm not a security expert, so I'm going by the article)
Re:Bitwarden Design Flaw
by justusthane on Tuesday January 24, 2023 @07:07AM
(#34502572)
The whole point of the linked article is that the due to a BitWarden design flaw the server iterations are meaningless — only the client iterations count.
When I see that I read: "With our knowledge of security and encryption, which by the way is much greater than yours, we consider that 100,000 is a perfectly safe number and a good middle point so go ahead and use it".
Am I wrong to think like that? My Master password is a battery-horse-staple thing, but not with 12 words as some other commenter says; that's absurdly long and would be too difficult for me to remember. I usually strive for around 18-20 characters, that's already in the verge of me forgetting it. I use incorrect or derived words of my own (so not really existing in dictionaries).