4 ms·

In the comments on the article, someone asks about Bitwarden. The author mentions there's a possible vulnerability, but in depth research isn't worth it, becaus

In the comments on the article, someone asks about Bitwarden. The author mentions there's a possible vulnerability, but in depth research isn't worth it, because he doesn't get paid for reporting vulnerabilities. This scares me about all these 'better than Lastpass' open source alternatives. First, they tend to get less attention from the infosec community. Secondly, I need to make sure to properly secure the server I'm running it on myself, of which I'm not 100% sure I can do myself, nor most developers I've worked with, let alone any person not working in IT.

htfy96 8y ago
Bitwarden paid for a third-party security audit last year and no major issues were found.[0] They also have their own bug bounty program at [1]. [0]: https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdf https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assess... [1]: https://hackerone.com/bitwarden https://hackerone.com/bitwarden
- org3432 8y ago
  Audits can be hit and miss, I’ve seen high quality code review companies just miss major and obvious mistakes in the security by simply not tracing the execution logic step by step in critical code sections and instead just scan the code for common known mistakes based on code fragment matching.
  - craftyguy 8y ago
    > Audits can be hit and miss, The same could be said for proprietary applications, which may never see third party audits because 'meh, customers have no access to our source and IP protection or something'
- zulln 8y ago
  They have a vulnerable disclosure program, not bug bounty, as they are not paying for bugs reported there. Which is a shame, I have reported bugs to a lot of other password managers, but will not dedicate time to one that is not paying me for it.
  - pbhjpbhj 8y ago
    They're 'paying' you by being part of a movement to improve society for everyone; which includes free use of their software. Sure, you can't eat that, but man does not live on bread alone. You'd tell a neighbour if they'd accidentally left their car door open, wouldn't you? Most people would even shut the door if they weren't around. Same principle.
    - therealx 8y ago
      That's not a fair use of word "pay". I get where you are coming from but it's obvious what he means and feels manipulative to use it that way.
    - sfopdxnonstop 8y ago
      Sure but we wouldn't go out looking for open doors. If you want me to patrol then you need to pay me.
    - deleted 8y ago
      [deleted]
    - krageon 8y ago
      > Most people would even shut the door if they weren't around. Same principle. This is a poor example because finding bugs requires a lot more effort than giving a door a push (which I find a little spurious - I wouldn't touch my neighbours' car). There is in practice an almost infinite amount of things you can donate time to and all else being equal (for example, they're all password managers) I doubt you'll convince most people by telling them they should do it because "it makes things better for everyone", they could be making everything better for everyone and still getting paid - that's the superior option. Even if I think you are correct.
    - zulln 8y ago
      I appreciate that they have a good way of contacting them with security issues, and if I found any by accident or used to tool daily myself I might report stuff. However, I will not dedicate time hacking something I do not use myself, to report stuff for free.
gcommer 8y ago
> I need to make sure to properly secure the server I'm running it on myself I think, for practically everyone, it is far more likely that shared infrastructure (like LP or hosted bitwarden) would be centrally compromised. For example, this post mentioned compromising a safety check for all lastpass users by finding a single vulnerability on a single lastpass domain. Unless you go to extreme lengths with your personal opsec, a targeted attack by a skilled attacker is pretty much sure to be able to compromise you. (In fairness, I don't actually know if self hosted bitwarden is enough for all classes of attacks or if I should also compile the clients myself in order to remove any references to the main bitwarden domain)
- tatersolid 8y ago
  > I think, for practically everyone, it is far more likely that shared infrastructure (like LP or hosted bitwarden) would be centrally compromised. I believe the opposite to be true. Any use of Shodan or any vulnerability scan of the public internet provides strong evidence that centralized, funded and focused services do security better than 99% of orgs and individuals. You can’t run infrastructure and app security better than a specialist SaaS company. You don’t have the same time and money. Yes, the blast radius is smaller for self-hosting, but that’s small comfort when you are still inside the blast radius.
  - Faark 8y ago
    Attackers will spend resources proportional to the expected reward. Alone I am a low value target, but using a standardized solution makes me part of a huge reward pool. As such my strategy is to require manual work by the attacker to compromise me. Combining a few of the shelf components (dropbox + keepass in my case) should be easy enough to not screw up so badly it isn't worth putting your eggs in a different basket as everyone else.
GLjEI4YbnGD27LB 8y ago
If you can pass your password database via something like dropbox (or your own nextcloud), then KeePass has had audits, for example by the European Commission's EU Free and Open Source Software Auditing project. And you don't have to trust your server that does the syncing.
- severine 8y ago
  > KeePass has had audits, for example by the European Commission's EU Free and Open Source Software Auditing project Link: https://joinup.ec.europa.eu/sites/default/files/ckeditor_files/files/DLV%20WP6%20-02-%20Summary%20of%20the%20evaluation%20of%20results%20_KeePass_published.pdf https://joinup.ec.europa.eu/sites/default/files/ckeditor_fil...
- StavrosK 8y ago
  Plus KeePass has the best Android client out of any password service, KeePass2Android.
  - j16sdiz 8y ago
    KeePass2Android don't have those audit
  - simcop2387 8y ago
    The semi-recent ability for it to work with android's built in password filling has been really nice for me. It now works properly with firefox android out of the box, selecting the correct username/password based on the url. Previously the best way was to use the keyboard that it comes with and select the password yourself. Now it works everywhere.
jammygit 8y ago
In terms of intentions, Bitwarden is very open and attempts to do everything right while putting itself under scrutiny. I suspect that as the company gains more and more users they will grow into the top choice, ie, when they get the cash to hire 1-2 more developers (or even afford a high-paying bug bounty system, ) For example, I chimed in on github semi recently about there being a lack of automated tests and within a week somebody claimed to have decided to prioritize it. With other companies, 1) we wouldn't have known, and 2) we wouldn't ever know if it was fixed TLDR, long term looks great for bitwarden, short term makes me a tiny bit nervous though Edit: looks like they added 3 test files that I could find, which isn't terribly comprehensive but I assume there are more I missed on the other repos...

htfy96 8y ago

Bitwarden paid for a third-party security audit last year and no major issues were found.[0] They also have their own bug bounty program at [1]. [0]: https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdf https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assess... [1]: https://hackerone.com/bitwarden https://hackerone.com/bitwarden

org3432 8y ago
Audits can be hit and miss, I’ve seen high quality code review companies just miss major and obvious mistakes in the security by simply not tracing the execution logic step by step in critical code sections and instead just scan the code for common known mistakes based on code fragment matching.
- craftyguy 8y ago
  > Audits can be hit and miss, The same could be said for proprietary applications, which may never see third party audits because 'meh, customers have no access to our source and IP protection or something'
zulln 8y ago
They have a vulnerable disclosure program, not bug bounty, as they are not paying for bugs reported there. Which is a shame, I have reported bugs to a lot of other password managers, but will not dedicate time to one that is not paying me for it.
- pbhjpbhj 8y ago
  They're 'paying' you by being part of a movement to improve society for everyone; which includes free use of their software. Sure, you can't eat that, but man does not live on bread alone. You'd tell a neighbour if they'd accidentally left their car door open, wouldn't you? Most people would even shut the door if they weren't around. Same principle.
  - therealx 8y ago
    That's not a fair use of word "pay". I get where you are coming from but it's obvious what he means and feels manipulative to use it that way.
  - sfopdxnonstop 8y ago
    Sure but we wouldn't go out looking for open doors. If you want me to patrol then you need to pay me.
  - deleted 8y ago
    [deleted]
  - krageon 8y ago
    > Most people would even shut the door if they weren't around. Same principle. This is a poor example because finding bugs requires a lot more effort than giving a door a push (which I find a little spurious - I wouldn't touch my neighbours' car). There is in practice an almost infinite amount of things you can donate time to and all else being equal (for example, they're all password managers) I doubt you'll convince most people by telling them they should do it because "it makes things better for everyone", they could be making everything better for everyone and still getting paid - that's the superior option. Even if I think you are correct.
  - zulln 8y ago
    I appreciate that they have a good way of contacting them with security issues, and if I found any by accident or used to tool daily myself I might report stuff. However, I will not dedicate time hacking something I do not use myself, to report stuff for free.

gcommer 8y ago

> I need to make sure to properly secure the server I'm running it on myself I think, for practically everyone, it is far more likely that shared infrastructure (like LP or hosted bitwarden) would be centrally compromised. For example, this post mentioned compromising a safety check for all lastpass users by finding a single vulnerability on a single lastpass domain. Unless you go to extreme lengths with your personal opsec, a targeted attack by a skilled attacker is pretty much sure to be able to compromise you. (In fairness, I don't actually know if self hosted bitwarden is enough for all classes of attacks or if I should also compile the clients myself in order to remove any references to the main bitwarden domain)

tatersolid 8y ago
> I think, for practically everyone, it is far more likely that shared infrastructure (like LP or hosted bitwarden) would be centrally compromised. I believe the opposite to be true. Any use of Shodan or any vulnerability scan of the public internet provides strong evidence that centralized, funded and focused services do security better than 99% of orgs and individuals. You can’t run infrastructure and app security better than a specialist SaaS company. You don’t have the same time and money. Yes, the blast radius is smaller for self-hosting, but that’s small comfort when you are still inside the blast radius.
- Faark 8y ago
  Attackers will spend resources proportional to the expected reward. Alone I am a low value target, but using a standardized solution makes me part of a huge reward pool. As such my strategy is to require manual work by the attacker to compromise me. Combining a few of the shelf components (dropbox + keepass in my case) should be easy enough to not screw up so badly it isn't worth putting your eggs in a different basket as everyone else.

GLjEI4YbnGD27LB 8y ago

If you can pass your password database via something like dropbox (or your own nextcloud), then KeePass has had audits, for example by the European Commission's EU Free and Open Source Software Auditing project. And you don't have to trust your server that does the syncing.

severine 8y ago
> KeePass has had audits, for example by the European Commission's EU Free and Open Source Software Auditing project Link: https://joinup.ec.europa.eu/sites/default/files/ckeditor_files/files/DLV%20WP6%20-02-%20Summary%20of%20the%20evaluation%20of%20results%20_KeePass_published.pdf https://joinup.ec.europa.eu/sites/default/files/ckeditor_fil...
StavrosK 8y ago
Plus KeePass has the best Android client out of any password service, KeePass2Android.
- j16sdiz 8y ago
  KeePass2Android don't have those audit
- simcop2387 8y ago
  The semi-recent ability for it to work with android's built in password filling has been really nice for me. It now works properly with firefox android out of the box, selecting the correct username/password based on the url. Previously the best way was to use the keyboard that it comes with and select the password yourself. Now it works everywhere.

jammygit 8y ago

In terms of intentions, Bitwarden is very open and attempts to do everything right while putting itself under scrutiny. I suspect that as the company gains more and more users they will grow into the top choice, ie, when they get the cash to hire 1-2 more developers (or even afford a high-paying bug bounty system, ) For example, I chimed in on github semi recently about there being a lack of automated tests and within a week somebody claimed to have decided to prioritize it. With other companies, 1) we wouldn't have known, and 2) we wouldn't ever know if it was fixed TLDR, long term looks great for bitwarden, short term makes me a tiny bit nervous though Edit: looks like they added 3 test files that I could find, which isn't terribly comprehensive but I assume there are more I missed on the other repos...