3 ms·
So is the TL;DR by default bitwarden sends basic auth (always, even if 'autofill' is off, because of limitations of the webextension API) to other subdomains (u
by EE84M3i 6y ago
So is the TL;DR by default bitwarden sends basic auth (always, even if 'autofill' is off, because of limitations of the webextension API) to other subdomains (up to the public suffix), people don't like this because they use broken sites that aren't on the PSL list but are effectively public suffixes, and so bitwarden is changing the default to only send basic auth to strict hostname matches?
This seems like kind of a nothingburger security wise to me.
- mritzmann 6y agoSo, you think it is my fault when Bitwarden send my Password to a site without my consence?
- EE84M3i 6y agoI'm saying it's the website's fault for not being on the PSL. If they have different trust for different subdomains and they're not on the PSL they're broken for other reasons (like cookies) anyway.