Hunting for Bitwarden master passwords stored in memory

Posted by markuta on Tuesday July 04, 2023 @04:20AM
from the redmaple.tech dept.

https://redmaple.tech/blogs/2023/extract-bitwarden-vault-passwords/

( 2 comments | on HN )

Re:Hunting for Bitwarden master passwords stored in memory by donmcronald on Tuesday July 04, 2023 @01:54PM (#36590240)

I wonder if there's any difference if you use the option to sign in with Windows Hello using a TPM. What about logout vs lock?

[ Parent | on HN ]

Re:Hunting for Bitwarden master passwords stored in memory by tentacleuno on Wednesday July 05, 2023 @07:35AM (#36598887)

I'm guessing they've built the desktop client in JavaScript. One disadvantage of the language (and all similar ones!) is that the GC isn't deterministic. Without access to Node's gc() API, it's very hard to ensure the credentials are wiped from memory after locking.

[ Parent | on HN ]