3 ms·

Bitwarden is fully open source and audited. You can self host the server and client if you want without additional cost (they charge small per user).

sneak 7y ago
Bitwarden derives its keys using SHA256 on the passphrase and a hilariously low iteration count. The developer refuses to acknowledge it as a security risk, and actually caps the max iterations you can configure, both on the client and the server. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 https://github.com/bitwarden/server/issues/589 “It was audited” is meaningless if the audit missed this, or reported this and the dev dismissed it. Either way, it is unsafe.
- phonon 7y ago
  It looks like people are getting confusing between using SHA256 directly as a key stretching mechanism, and what PBKDF2-SHA256 is. https://crypto.stackexchange.com/a/61306 https://crypto.stackexchange.com/a/61306 Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/auth/hashers.py#L238 https://github.com/django/django/blob/master/django/contrib/... Given Bitwarden allows almost 10x that, not sure I see the issue.
  - deleted 7y ago
    [deleted]
  - sneak 7y ago
    Bitwarden’s auth protocol allows the server to tell the client that the iteration count is 5000, regardless of the actual iteration count, and the client will send 5000-iteration passphrase-derived material to the bitwarden server (run by the developer in the usual case). PBKDF-SHA256 is far too fast, even with the HMAC step.
    - tmikaeld 7y ago
      In the Audit they pointed this out, but didn't see it as a huge issue. I'd rather they use Argon2id to be as safe as can be. However, I've not yet seen a fully cross-platform javascript-only implementation of Argon2 at all, which is problematic for an extension.. :-/ UPDATE: There actually exist an Argon2 implementation that's used by another vault, https://www.npmjs.com/package/argon2-browser https://www.npmjs.com/package/argon2-browser
    - phonon 7y ago
      Errr...most systems (like Django) send passwords in plaintext to the server! (Over SSL of course). The point of PBKDF-SHA256 is to protect the secrecy of passwords if the server is compromised and its password hash db is dumped.
      - sneak 7y ago
        Django’s auth system is for a single site. Bitwarden’s master passphrase protects the key that decrypts my password for every single site I use. This is not some random webapp. It is a password manager.
        phonon 7y ago
        So use a longer password with BitWarden. Think about it.

sneak 7y ago

Bitwarden derives its keys using SHA256 on the passphrase and a hilariously low iteration count. The developer refuses to acknowledge it as a security risk, and actually caps the max iterations you can configure, both on the client and the server. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 https://github.com/bitwarden/server/issues/589 “It was audited” is meaningless if the audit missed this, or reported this and the dev dismissed it. Either way, it is unsafe.

phonon 7y ago
It looks like people are getting confusing between using SHA256 directly as a key stretching mechanism, and what PBKDF2-SHA256 is. https://crypto.stackexchange.com/a/61306 https://crypto.stackexchange.com/a/61306 Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/auth/hashers.py#L238 https://github.com/django/django/blob/master/django/contrib/... Given Bitwarden allows almost 10x that, not sure I see the issue.
- deleted 7y ago
  [deleted]
- sneak 7y ago
  Bitwarden’s auth protocol allows the server to tell the client that the iteration count is 5000, regardless of the actual iteration count, and the client will send 5000-iteration passphrase-derived material to the bitwarden server (run by the developer in the usual case). PBKDF-SHA256 is far too fast, even with the HMAC step.
  - tmikaeld 7y ago
    In the Audit they pointed this out, but didn't see it as a huge issue. I'd rather they use Argon2id to be as safe as can be. However, I've not yet seen a fully cross-platform javascript-only implementation of Argon2 at all, which is problematic for an extension.. :-/ UPDATE: There actually exist an Argon2 implementation that's used by another vault, https://www.npmjs.com/package/argon2-browser https://www.npmjs.com/package/argon2-browser
  - phonon 7y ago
    Errr...most systems (like Django) send passwords in plaintext to the server! (Over SSL of course). The point of PBKDF-SHA256 is to protect the secrecy of passwords if the server is compromised and its password hash db is dumped.
    - sneak 7y ago
      Django’s auth system is for a single site. Bitwarden’s master passphrase protects the key that decrypts my password for every single site I use. This is not some random webapp. It is a password manager.
      - phonon 7y ago
        So use a longer password with BitWarden. Think about it.