4 ms·

Interesting, albeit a bit lightweight as compared to the similar document from 1Password: https://support.1password.com/cs/opvault-design/ https://support.1pass

Interesting, albeit a bit lightweight as compared to the similar document from 1Password: https://support.1password.com/cs/opvault-design/ https://support.1password.com/cs/opvault-design/ (yes, I recognize it's a tiny bit apples-to-oranges since 1P has now gone whole hog toward their b2 API) Speaking of which, I presume Huy doesn't work for Bitwarden, so it's unfortunate they needed some independent blogger to write up their auth scheme. I do realize there's an independent implementation in Vaultwarden, so that's almost better than a spec -- just as long as Vaultwarden was a clean-room impl and thus reading that code is "legally safe."

cobythedog 5y ago
> it's unfortunate they needed some independent blogger to write up their auth scheme That's kind of a odd statement, no? The information is provided by Bitwarden and easily found, for example: * https://bitwarden.com/help/what-encryption-is-used/ https://bitwarden.com/help/what-encryption-is-used/ * https://bitwarden.com/blog/end-to-end-encryption-and-zero-knowledge/ https://bitwarden.com/blog/end-to-end-encryption-and-zero-kn...
- mdaniel 5y ago
  I feel pretty confident is saying that Huy's content is more technical than a blog post about "end to end encryption," and neither hold a candle to the level of specificity in that opvault-design document. So maybe you found it to be an odd statement, I dunno, but I stand by that it is unfortunate that they needed someone independent person to dive into that level of technical detail
  - 42jd 5y ago
    Any password manager worth their salt has a white paper with their security design. Here is Bitwarden’s: https://bitwarden.com/images/resources/security-white-paper-download.pdf https://bitwarden.com/images/resources/security-white-paper-...
    - mdaniel 5y ago
      Thank you for the link > (c) Bitwarden, Inc. CONFIDENTIAL well, that's a weird thing to put in a white paper
piaste 5y ago
> I do realize there's an independent implementation in Vaultwarden, so that's almost better than a spec -- just as long as Vaultwarden was a clean-room impl and thus reading that code is "legally safe." Vaultwarden is a server implementation, though. As the article also points out, the *warden server is little more than a basic REST API, all the cryptographically fun parts happen on the client side, for which there are only the official implementations so far.

cobythedog 5y ago

> it's unfortunate they needed some independent blogger to write up their auth scheme That's kind of a odd statement, no? The information is provided by Bitwarden and easily found, for example: * https://bitwarden.com/help/what-encryption-is-used/ https://bitwarden.com/help/what-encryption-is-used/ * https://bitwarden.com/blog/end-to-end-encryption-and-zero-knowledge/ https://bitwarden.com/blog/end-to-end-encryption-and-zero-kn...

mdaniel 5y ago
I feel pretty confident is saying that Huy's content is more technical than a blog post about "end to end encryption," and neither hold a candle to the level of specificity in that opvault-design document. So maybe you found it to be an odd statement, I dunno, but I stand by that it is unfortunate that they needed someone independent person to dive into that level of technical detail
- 42jd 5y ago
  Any password manager worth their salt has a white paper with their security design. Here is Bitwarden’s: https://bitwarden.com/images/resources/security-white-paper-download.pdf https://bitwarden.com/images/resources/security-white-paper-...
  - mdaniel 5y ago
    Thank you for the link > (c) Bitwarden, Inc. CONFIDENTIAL well, that's a weird thing to put in a white paper

piaste 5y ago

> I do realize there's an independent implementation in Vaultwarden, so that's almost better than a spec -- just as long as Vaultwarden was a clean-room impl and thus reading that code is "legally safe." Vaultwarden is a server implementation, though. As the article also points out, the *warden server is little more than a basic REST API, all the cryptographically fun parts happen on the client side, for which there are only the official implementations so far.