3 ms·
How do they decrypt the vault without the master password?
by brigandish 6y ago
How do they decrypt the vault without the master password?
- sneak 6y agoBy replacing the client code with code that exfiltrates the password the next time you enter it. Alternately, brute forcing the client password is straightforward due to their use of a too-fast KDF and low iteration count. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 https://github.com/bitwarden/server/issues/589
- brigandish 6y agoI agree that automatic updates should have a toggle, Signal desktop is another client where the devs won't provide one and have even taken egregious steps to prevent blocking it. Run in a reduced-privilege account though and either client will still require your assent via the admin rights to install. You're also right about the KDF but to be fair to them the devs say they'll accept work from a fork[0] to Argon2, if and when it's done (properly). [0] https://community.bitwarden.com/t/switch-to-argon2/350/24 https://community.bitwarden.com/t/switch-to-argon2/350/24