4 ms·
I'm guessing this solves a very specific pet peeve of mine: When your bitwarden vault is not opened, if you log in to website, the extension will ask if you wa
by themoonisachees 4y ago
I'm guessing this solves a very specific pet peeve of mine:
When your bitwarden vault is not opened, if you log in to website, the extension will ask if you want to store the password, even if your vault already has an entry for that website. Of course, this is by design so that bitwarden doesn't store websites you have credentials for in plaintext (unlike lastpass and it blew up in their face).
Would this allow your browser to query a database of "domains i have a password for" without a leak on bitwarden's server exposing this exact database? There are other implementation details but you get the idea.
- julvo 4y agowouldn't salting and hashing be enough for this use case if you keep the salt on the client?
- paulryanrogers 4y agoOr even a bloom filter?
- malf 4y agoSame problem as “hash the PIN code”, an attacker can run the algorithm for Alexa-1M.csv.
- forty 4y agoThe most logical way would be to a copy of your vault stored locally when you first login (then kept in sync using shared secret with the server) - as far as I known most password managers work this way (no idea for bitwarden). This should enable schemes when it can check locally if your vault contain a given website, rather than having to reach a server for each website you visit.