5 ms·
Indeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more
by d-z-m 4y ago
Indeed, which is why Bitwarden should disallow pin-only access for offline vault data altogether. Admittedly, I'm valuing a safe interface for users much more highly than one that is convenient or ergonomic.
- poisonborz 4y agoIt's the user's choice.
- mynameisvlad 4y agoI mean, sure, but if the user isn’t appropriately informed of the risks (such as this attack) how would you expect them to make a good choice?
- d-z-m 4y agoCurrently it is, yes. In this case, I'm arguing that it should not be.
- poisonborz 4y agoThat would go against the nature of such software. Let's treat users as adults. There should be warnings. But this is a feature. Users shouldn't be able to eg. select weak crypto algos, there is no additional functionality in that. But setting whatever pin is a convenience, and users should be able to decide what threat vectors they accept.
- nicoburns 4y agoIf it’s n or convenient then users won’t use a password manager at all: