5 ms·
Not allowing people the convenience they want means they'll switch to a method that does. Worst case: a passwords.txt. Wouldn't that be a worse downgrade attack
by ThatPlayer 4y ago
Not allowing people the convenience they want means they'll switch to a method that does. Worst case: a passwords.txt. Wouldn't that be a worse downgrade attack?
- 1attice 4y agoI have no opinion other than it is obviously a downgrade attack. As a fair to middling organic language model, I cannot tell you how to keep your keys safe; I myself am blessed with a good memory and 160wpm typing speed so I use that.
- ThatPlayer 4y agoAs you say yourself, that is a blessing, and not everyone has it. Only allowing those with such blessings to use Bitwarden doesn't help anyone.
- 1attice 4y agoAgain, as a fair-to-middling organic language model, my only opinion is that, a PIN, as currently implemented in Bitwarden and described above, leaves Bitwarden users open to a form of exploitation that can be categorized as a downgrade attack. Presumably, a better implementation would be fine. You are free to keep using Bitwarden's PIN implementation, but it will still be open to: downgrade attack. This is because Bitwarden's security, as described in this article, is open to: downgrade attack. This is not an emotional term. It is no more laden with implication than observing that #F00 is 'red'. You are free to keep using #F00, just don't call it blue. Donwgrade attacks are relatively straightforward, and ease-of-use features, such as PINs, are a traditional place to look for them. I have no opinion on this matter other than that it implies that Bitwarden can be configured in a manner which is insecure, and the specific form of insecurity is: openness to downgrade attack.