Suggestion: Passward Manager - BitWarden #376

New Issue

2017-12-18T19:07:21Z

amdelamar commented

2017-12-18 19:07:21 +00:00

(Migrated from github.com)

I think bitwarden should be listed under Password Managers here.

For privacy features I know:

Its open-source on GitHub https://github.com/bitwarden
You can self-host your own server
Master password + 2FA (also FIDO U2F, Yubikey, and more)
Encryption via PBKDF2 AES 256bit

Maybe @kspearrin can elaborate a more on the privacy aspect of bitwarden over other competitors.

I think [bitwarden](https://bitwarden.com/) should be listed under Password Managers [here](https://www.privacytools.io/#pw). For privacy features I know: * Its open-source on GitHub https://github.com/bitwarden * You can self-host your own server * Master password + 2FA (also FIDO U2F, Yubikey, and more) * Encryption via PBKDF2 AES 256bit Maybe @kspearrin can elaborate a more on the privacy aspect of bitwarden over other competitors.

👍 13

dittaeva commented

2018-06-04 11:15:39 +00:00

(Migrated from github.com)

I think a comment on this is warranted. None of the current three suggestions will replace the most common password manager LastPass, but BitWarden can (and is designed to). Master Password relies on you remembering site address and username, KeePass is not in the browser (unless you install extra software with the usability advantages and security disadvantages implied), LessPass seems to be essentially the same as Master Password, and there seems to be several others like it.

I am not saying BitWarden deserves a place among the three, but from the descriptions it does seem to warrant place no. 3 more than LessPass. But then again maybe LessPass is a better choice for number 1 as it has syncing for complex passwords.

I think a comment on this is warranted. None of the current three suggestions will replace the most common password manager LastPass, but BitWarden can (and is designed to). Master Password relies on you remembering site address and username, KeePass is not in the browser (unless you install extra software with the usability advantages and security disadvantages implied), LessPass seems to be essentially the same as Master Password, and there seems to be several others like it. I am not saying BitWarden deserves a place among the three, but from the descriptions it does seem to warrant place no. 3 more than LessPass. But then again maybe LessPass is a better choice for number 1 as it has syncing for complex passwords.

👍 1

beerisgood commented

2018-06-05 04:11:12 +00:00

(Migrated from github.com)

I never got why you guys need a password manager in Browser. And if this isnt bad enough, its in Cloud.
I cant recommend both

I never got why you guys need a password manager in Browser. And if this isnt bad enough, its in Cloud. I cant recommend both

walrus543 commented

2018-06-07 09:02:43 +00:00

(Migrated from github.com)

@beerisgood Multi-users, multi-devices, multi-platforms.
Easy to use for everybody.
I use Bitwarden since it has been introduced by Kyle (Bitwarden's dev) on Reddit.

@beerisgood Multi-users, multi-devices, multi-platforms. Easy to use for everybody. I use Bitwarden since it has been introduced by Kyle (Bitwarden's dev) on Reddit.

beerisgood commented

2018-06-07 18:41:38 +00:00

(Migrated from github.com)

@Primokorn: KeePass can do that too. Even without a browser.
Of course the program is needed then

@Primokorn: KeePass can do that too. Even without a browser. Of course the program is needed then

swr7hr commented

2018-09-21 15:28:08 +00:00

(Migrated from github.com)

I would like to put forward Bitwarden again to be added to the password managers on privacytool.io.

To build apon the reasons already given, here are mine:

Being able to self host is a great feature and the iSO app can be used with self hosting.
While KeePass is also open source, it uses Google Authenticator which no longer is.
For Bitwarden, I use (and would also recommend) FreeOTP so it remains open source.
2a. Trust in Google (and others) around privacy and rights has gone right down due to FOSTA
The support provided by Kyle is really good. He is quick to get back and provide help and keep it evolving.
I am not saying it should replace KeePass but it seems to be giving it a run of its money and winning.
On privacy tools.io's reddit, followers have also tested and liked Bitwarden.
They just released a desktop app for those who want it.

Even if its a mention, they seem to be hitting more rights than most. I also did a check on the site this time too.
https://webbkoll.dataskydd.net/en/results?url=http%3A%2F%2Fvault.bitwarden.com%2F

Thanks for your time.

Just a Privacy Fan - Not a Developer

I would like to put forward Bitwarden again to be added to the password managers on privacytool.io. To build apon the reasons already given, here are mine: 1. Being able to self host is a great feature and the iSO app can be used with self hosting. 2. While KeePass is also open source, it uses Google Authenticator which [no longer is](https://www.reddit.com/r/Bitcoin/comments/3fkmvi/using_google_authenticator_app_for_2fa/). For Bitwarden, I use (and would also recommend) [FreeOTP](https://lwn.net/Articles/581086/) so it remains open source. 2a. Trust in Google (and others) around [privacy and rights](https://www.techrepublic.com/article/why-passage-of-sestafosta-is-leading-some-cloud-providers-to-terminate-users/) has gone right down due to FOSTA 3. The support provided by Kyle is really good. He is quick to get back and provide help and keep it evolving. 4. I am not saying it should replace KeePass but it seems to be giving it a run of its money and [winning](https://www.slant.co/versus/2824/19421/~keepass_vs_bitwarden). 5. On privacy tools.io's [reddit](https://www.reddit.com/r/privacytoolsIO/comments/7vtrqm/keepass_vs_bitwarden_vs_enpass/), followers have also tested and liked Bitwarden. 6. They just released a [desktop app](https://www.ghacks.net/2018/03/01/bitwarden-desktop-app-released/) for those who want it. Even if its a mention, they seem to be hitting more rights than most. I also did a check on the site this time too. https://webbkoll.dataskydd.net/en/results?url=http%3A%2F%2Fvault.bitwarden.com%2F Thanks for your time. Just a Privacy Fan - Not a Developer

👎 1

beerisgood commented

2018-09-21 20:26:14 +00:00

(Migrated from github.com)

@swr7hr what? Keepass doesn't use any Google stuff

ProgressiveArchitect commented

2018-10-18 19:39:22 +00:00

(Migrated from github.com)

Bitwarden is a fantastic project with a lot of potential to overtake Keepass & KeepassXC from a User Interface perspective. It just has a much better GUI and has a dedicated app for most platforms out there. It additionally has the ability to self host, Which is a major attribute to its dedication to privacy. Unfortunately the default is to host on Bitwarden's cloud, Which is a big negative. However it is end to end encrypted, which you can prove due to the application client being open source.

For now I don't believe privacytools.io should be recommending Bitwarden until it has undergone an Independent Third Party Security Audit. Once it has had one and passes, Then I think it has earned a spot on the privacytools.io recommended list.

Many of the users who follow privacytools.io are already using Bitwarden and can verify it as a very good and privacy respecting Password Manager. But regardless, It still needs a proper Security Audit.

Unrelated: I would remove Brave Browser from the "privacytools.io recommended list" until a time when it has undergone a Independent Third Party Security Audit.

Bitwarden is a fantastic project with a lot of potential to overtake Keepass & KeepassXC from a User Interface perspective. It just has a much better GUI and has a dedicated app for most platforms out there. It additionally has the ability to self host, Which is a major attribute to its dedication to privacy. Unfortunately the default is to host on Bitwarden's cloud, Which is a big negative. However it is end to end encrypted, which you can prove due to the application client being open source. For now I don't believe privacytools.io should be recommending Bitwarden until it has undergone an Independent Third Party Security Audit. Once it has had one and passes, Then I think it has earned a spot on the privacytools.io recommended list. Many of the users who follow privacytools.io are already using Bitwarden and can verify it as a very good and privacy respecting Password Manager. But regardless, It still needs a proper Security Audit. Unrelated: I would remove Brave Browser from the "privacytools.io recommended list" until a time when it has undergone a Independent Third Party Security Audit.

bocekm commented

2018-11-13 18:07:39 +00:00

(Migrated from github.com)

@ProgressiveArchitect, security audit of Bitwarden complete: https://blog.bitwarden.com/bitwarden-completes-third-party-security-audit-c1cc81b6d33

ghost commented

2018-11-13 18:08:26 +00:00

(Migrated from github.com)

Can anyone create a PR?

Vincevrp commented

2018-11-13 19:50:27 +00:00

(Migrated from github.com)

@Shifterovich I can implement this. Which place should it take in the recommendations?

ghost commented

2018-11-13 20:01:30 +00:00

(Migrated from github.com)

Seems like it's cloud-based but with client-side encryption? I personally use KeePass and LessPass, I've never used Master Password. I'd replace either Master Password or LessPass, since they both do the same thing. That way we will have all 3 types there.

Vincevrp commented

2018-11-13 20:05:01 +00:00

(Migrated from github.com)

I suggest:

LessPass
KeePass
Bitwarden

Or maybe switch the first two?

I suggest: 1. LessPass 1. KeePass 1. Bitwarden Or maybe switch the first two?

ghost commented

2018-11-13 20:21:35 +00:00

(Migrated from github.com)

I agree, use whatever order for LessPass and KeePass to make it aesthetically pleasing (I suspect the LessPass color will work great with primary).

I agree, use whatever order for LessPass and KeePass to make it aesthetically pleasing (I suspect the LessPass color will work great with `primary`).

Vincevrp commented

2018-11-13 20:51:50 +00:00

(Migrated from github.com)

Okay, I will implement this. You can assign me to this issue.

kspearrin commented

2018-11-13 20:52:49 +00:00

(Migrated from github.com)

@Vincevrp This repo might help: https://github.com/bitwarden/brand

👍 1

ghost commented

2018-11-13 21:22:29 +00:00

(Migrated from github.com)

@Vincevrp I can't assign non-collaborators unfortunately. Nevermind. @kspearrin thanks.

Offpics commented

2018-11-13 22:34:07 +00:00

(Migrated from github.com)

To be honest this is the first audit that I've ever given a quick glance. I guess 11 identified problems is a low number. But the conclusion is kinda worrying for me.

On a less positive note, the assessment of the deployed cryptographic design led to the discovery of certain issues that must be addressed in due course. One was rated “Critical” because a malicious vault could obtain and modify organization items. This approach relied on MitM attack described in BWN-01-008. The overall code quality of the crypto implementations was deemed to be overly complex and frequently misleading, which led to reporting a false positive issue (see BWN-01-011). More generally, cryptographic libraries of the Bitwarden compound have not yet been optimized. They particularly need to be simplified as unnecessary complexity can lead to problems.

Given the number and range of issues discovered, it seems necessary that a re-design takes place. This needs to reassess how certain features are implemented and ensure that the overall cryptography stands strong against the attackers’ efforts.

To be honest this is the first audit that I've ever given a quick glance. I guess 11 identified problems is a low number. But the conclusion is kinda worrying for me. > On a less positive note, the assessment of the deployed cryptographic design led to the discovery of certain issues that must be addressed in due course. One was rated “Critical” because a malicious vault could obtain and modify organization items. This approach relied on MitM attack described in BWN-01-008. The overall code quality of the crypto implementations was deemed to be overly complex and frequently misleading, which led to reporting a false positive issue (see BWN-01-011). More generally, cryptographic libraries of the Bitwarden compound have not yet been optimized. They particularly need to be simplified as unnecessary complexity can lead to problems. > Given the number and range of issues discovered, it seems necessary that a re-design takes place. This needs to reassess how certain features are implemented and ensure that the overall cryptography stands strong against the attackers’ efforts.

kspearrin commented

2018-11-15 04:31:55 +00:00

(Migrated from github.com)

@Aquakor I am the lead developer of Bitwarden and was intimately involved in the security audit mentioned. I can understand that those two paragraphs may seem a bit concerning out of context. To provide more context, there were several points discussed between the Bitwarden developers and the auditing team about how we could redesign specific features (ex. organization user confirmations) so that the crypto implementations would be stronger and more resilient against certain attack vectors. A consensus was reached and that is what is being referenced here about re-designing things.

The purpose of an audit like this is to find issues. When issues are found, that is a good thing. We want to find problems so that they can be fixed. What would be bad is if we found issues that could not be properly fixed, or an abnormally large number of issues, neither of which was the case with Bitwarden. What I can tell you is that all issues referenced in this audit have already been resolved in very short order (the audit was only completed just last week), with relatively simple fixes, and that Bitwarden is even safer to use today than it was before.

@Aquakor I am the lead developer of Bitwarden and was intimately involved in the security audit mentioned. I can understand that those two paragraphs may seem a bit concerning out of context. To provide more context, there were several points discussed between the Bitwarden developers and the auditing team about how we could redesign specific features (ex. organization user confirmations) so that the crypto implementations would be stronger and more resilient against certain attack vectors. A consensus was reached and that is what is being referenced here about re-designing things. The purpose of an audit like this is to find issues. When issues are found, that is a good thing. We want to find problems so that they can be fixed. What would be bad is if we found issues that could not be properly fixed, or an abnormally large number of issues, neither of which was the case with Bitwarden. What I can tell you is that all issues referenced in this audit have already been resolved in very short order (the audit was only completed just last week), with relatively simple fixes, and that Bitwarden is even safer to use today than it was before.

👍 2

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#376