5 ms·

I took one look at BitWarden and, as a security person, ran the other way when I saw the CLI expects you to enter your password on the command line in order to

I took one look at BitWarden and, as a security person, ran the other way when I saw the CLI expects you to enter your password on the command line in order to operate it. This password gets exposed in your shell history, to anyone who can view a process list, etc. If a company writing a security product can be this incompetent about something so basic, I don’t have any interest in gambling that the rest of their product is any better.

xref 7y ago
You mean the cli doesn’t prompt you to type the pwd separate from the cli command itself, akin to how Postgres ‘psql -p’ works?
- stouset 7y ago
  According to the docs, all of the relevant commands accept the password as an argument to the binary itself. https://help.bitwarden.com/article/cli/ https://help.bitwarden.com/article/cli/
- krmbzds 7y ago
  It does. In fact, when you --help in the cli tool the first example it suggests is to login with "bw login" command which is the default way.
txcwpalpha 7y ago
Did you actually try using the CLI tool, or did you only read the documentation? The documentation isn't super clear, but in actual usage your password (nor your email) doesn't get entered into shell history or otherwise. You can pass your email and password as arguments to the "bw login [email] [password]" command, which will put them into your history, but the default way of typing "bw login" will then prompt you for them both, masking your password just like any other CLI tool does.
- stouset 7y ago
  If if you can do this, the fact that the documentation encourages you to do otherwise is extremely worrisome. Securely-written tools shouldn't even allow you to do this in the first place, much less promote it. https://help.bitwarden.com/article/cli/ https://help.bitwarden.com/article/cli/
  - krmbzds 7y ago
    I don't think it's extremely worrisome. The arguments are in brackets a.k.a. they are optional. If a user doesn't know that they probably shouldn't be using the command line tool in the first place. Besides, if you run help on the cli tool the first example it suggests is "bw login" (without the arguments).
Fnoord 7y ago
Regardless that this is one way to operate it (just like many CLI commands can also prompt for password) you're aware you can tell your shell to not save commands to its history?

xref 7y ago

You mean the cli doesn’t prompt you to type the pwd separate from the cli command itself, akin to how Postgres ‘psql -p’ works?

stouset 7y ago
According to the docs, all of the relevant commands accept the password as an argument to the binary itself. https://help.bitwarden.com/article/cli/ https://help.bitwarden.com/article/cli/
krmbzds 7y ago
It does. In fact, when you --help in the cli tool the first example it suggests is to login with "bw login" command which is the default way.

txcwpalpha 7y ago

Did you actually try using the CLI tool, or did you only read the documentation? The documentation isn't super clear, but in actual usage your password (nor your email) doesn't get entered into shell history or otherwise. You can pass your email and password as arguments to the "bw login [email] [password]" command, which will put them into your history, but the default way of typing "bw login" will then prompt you for them both, masking your password just like any other CLI tool does.

stouset 7y ago
If if you can do this, the fact that the documentation encourages you to do otherwise is extremely worrisome. Securely-written tools shouldn't even allow you to do this in the first place, much less promote it. https://help.bitwarden.com/article/cli/ https://help.bitwarden.com/article/cli/
- krmbzds 7y ago
  I don't think it's extremely worrisome. The arguments are in brackets a.k.a. they are optional. If a user doesn't know that they probably shouldn't be using the command line tool in the first place. Besides, if you run help on the cli tool the first example it suggests is "bw login" (without the arguments).

Fnoord 7y ago

Regardless that this is one way to operate it (just like many CLI commands can also prompt for password) you're aware you can tell your shell to not save commands to its history?