Add info tooltip for BitWarden to recommend registering through desktop clients #2329

2021-06-02T15:46:21Z

lrq3000 commented

2021-06-02 15:46:21 +00:00

(Migrated from github.com)

Description

Resolves: Suggestion by @ThracianKnight1907 at https://github.com/privacytools/privacytools.io/issues/1915#issuecomment-628417380

Check List

I understand that by not opening an issue about a software/service/similar addition/removal, this pull request will be closed without merging.
I have read and understand the contributing guidelines.
The project is Free Libre and/or Open Source Software

Netlify preview for the mainly edited page:

## Description Resolves: Suggestion by @ThracianKnight1907 at https://github.com/privacytools/privacytools.io/issues/1915#issuecomment-628417380 #### Check List  - [x] I understand that by not opening an issue about a software/service/similar addition/removal, this pull request will be closed without merging. - [x] I have read and understand [the contributing guidelines](https://github.com/privacytools/privacytools.io/blob/master/.github/CONTRIBUTING.md). - [x] The project is [Free Libre](https://en.wikipedia.org/wiki/Free_software) and/or [Open Source](https://en.wikipedia.org/wiki/Open-source_software) Software * Netlify preview for the mainly edited page:

freddy-m (Migrated from github.com) reviewed 2021-06-03 21:01:15 +00:00

freddy-m (Migrated from github.com) left a comment

LGTM

youdontneedtoknow22 commented

2021-06-09 00:19:37 +00:00

(Migrated from github.com)

I don't understand that point.
Bitwarden would use a malicious javascript to get the account password from someone signing IN, because he could have some important passwords saved.
But to sign UP using the client, is not important because you already don't have passwords in your account, you're about to make an account.
So the info added should be: Avoid signin in your Bitwared account using the browser. Sign up, set up your 2FA and never sign in again. Or am I missing something?

I don't understand that point. Bitwarden would use a malicious javascript to get the account password from someone signing IN, because he could have some important passwords saved. But to sign UP using the client, is not important because you already don't have passwords in your account, you're about to make an account. So the info added should be: Avoid signin in your Bitwared account using the browser. Sign up, set up your 2FA and never sign in again. Or am I missing something?

👍 1

lrq3000 commented

2021-06-09 02:23:15 +00:00

(Migrated from github.com)

It's not bitwarden the issue but keyloggers in malicious browser's
extensions for example. But yes i should also add sign is using app or
extension, thank you for the suggestion.

Le mer. 9 juin 2021 à 02:19, youdontneedtoknow22 @.***>
a écrit :

I don't understand that point.
Bitwarden would use a malicious javascript to get the account password
from someone signing IN, because he could have some important passwords
saved.
But to sign UP using the client, is not important because you already
don't have passwords in your account, you're about to make an account.
So the info added should be: Avoid signin in your Bitwared account using
the browser. Sign up, set up your 2FA and never sign in again. Or am I
missing something?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/privacytools/privacytools.io/pull/2329#issuecomment-857278773,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAIRFXVUPRJJ63RVW4AUGETTR2XSLANCNFSM457AJC7A
.

It's not bitwarden the issue but keyloggers in malicious browser's extensions for example. But yes i should also add sign is using app or extension, thank you for the suggestion. Le mer. 9 juin 2021 à 02:19, youdontneedtoknow22 ***@***.***> a écrit : > I don't understand that point. > Bitwarden would use a malicious javascript to get the account password > from someone signing IN, because he could have some important passwords > saved. > But to sign UP using the client, is not important because you already > don't have passwords in your account, you're about to make an account. > So the info added should be: Avoid signin in your Bitwared account using > the browser. Sign up, set up your 2FA and never sign in again. Or am I > missing something? > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <https://github.com/privacytools/privacytools.io/pull/2329#issuecomment-857278773>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAIRFXVUPRJJ63RVW4AUGETTR2XSLANCNFSM457AJC7A> > . >

youdontneedtoknow22 commented

2021-06-09 12:52:22 +00:00

(Migrated from github.com)

It's not bitwarden the issue but keyloggers in malicious browser's extensions for example. But yes i should also add sign is using app or extension, thank you for the suggestion. Le mer. 9 juin 2021 à 02:19, youdontneedtoknow22 @.***> a écrit :
…

If the Issue is a keylogger inside the browser, then the whole discussion with the jurisdiction of Bitwarden isn't relevant any more. I believe our friend there was refering to Bitwarden using a malicious javascript to steal the login information for a specific user, done by bitwarden. US Companies maybe forced to do such thing (Lavabit and Snowden Story)

Tbh I'm neither familiar with Keyloggers inside browser's addons nor Bitwarden (I use KeypassXC and Firefox Lockwise). I installed Bitwarden addon and 2 Keylogger Addons (not malicious, their job is literally to log keystrokes inside the browser). Those were:
Takker: https://addons.mozilla.org/en-US/firefox/addon/tackker-online-keylogger-tool/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search
Nifty Keylogger: https://addons.mozilla.org/en-US/firefox/addon/tackker-online-keylogger-tool/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search

Takker could log what I type in the urlbar and what I type inside a website. Nifty Keylogger logged only what I typed inside the website.
Both couldn't log what I typed inside the Bitwarden Addon. So I don't believe we should recommend signin in using the addon for this reason, but rather avoid signing in using the Bitwarden webvault to avoid potential malicious javascripts.

> It's not bitwarden the issue but keyloggers in malicious browser's extensions for example. But yes i should also add sign is using app or extension, thank you for the suggestion. Le mer. 9 juin 2021 à 02:19, youdontneedtoknow22 ***@***.***> a écrit : > […](#) If the Issue is a keylogger inside the browser, then the whole discussion with the jurisdiction of Bitwarden isn't relevant any more. I believe our friend there was refering to Bitwarden using a malicious javascript to steal the login information for a specific user, done by bitwarden. US Companies maybe forced to do such thing (Lavabit and Snowden Story) Tbh I'm neither familiar with Keyloggers inside browser's addons nor Bitwarden (I use KeypassXC and Firefox Lockwise). I installed Bitwarden addon and 2 Keylogger Addons (not malicious, their job is literally to log keystrokes inside the browser). Those were: Takker: https://addons.mozilla.org/en-US/firefox/addon/tackker-online-keylogger-tool/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search Nifty Keylogger: https://addons.mozilla.org/en-US/firefox/addon/tackker-online-keylogger-tool/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search Takker could log what I type in the urlbar and what I type inside a website. Nifty Keylogger logged only what I typed inside the website. Both couldn't log what I typed inside the Bitwarden Addon. So I don't believe we should recommend signin in using the addon for this reason, but rather avoid signing in using the Bitwarden webvault to avoid potential malicious javascripts.

👍 1

lrq3000 commented

2021-06-09 13:31:33 +00:00

(Migrated from github.com)

Yes the original suggestion was made in the context of Bitwarden being compromised, but this suggestion is also beneficial for other threats such as keyloggers as you tested, so I think the variety of issues that this tip solves is a good argument to add it, that's why I made this PR :-)

About sign-in, are these keyloggers able to capture autofilled passwords by Bitwarden plug-in? Because that's why I thought the plug-in was safer, and intended to add another tip about.

/EDIT: Oh wow, Tackker on Chrome can indeed capture autofilled passwords. It can also capture copy/pasted credentials.

Yes the original suggestion was made in the context of Bitwarden being compromised, but this suggestion is also beneficial for other threats such as keyloggers as you tested, so I think the variety of issues that this tip solves is a good argument to add it, that's why I made this PR :-) About sign-in, are these keyloggers able to capture autofilled passwords by Bitwarden plug-in? Because that's why I thought the plug-in was safer, and intended to add another tip about. /EDIT: Oh wow, Tackker on Chrome can indeed capture autofilled passwords. It can also capture copy/pasted credentials.

lrq3000 commented

2021-06-09 13:45:23 +00:00

(Migrated from github.com)

I have updated the tip per our discussion above. Please re-evaluate it.

youdontneedtoknow22 commented

2021-06-09 14:32:15 +00:00

(Migrated from github.com)

Yup, I belive this fixes the issue with the potential malicious javascripts.

not relevant to Bitwarden but:
if one wants also to avoid keyloggers and other malicious stuff in firefox addons, they should just use the Addons with the recommended Badge on them (covers pretty much every aspect, like donwloading Youtube videos, Blocking ads, sticky notes, etc..). These will always be checked by mozilla developers, each update for their source code as well. So they would be secure (less vulnerabilites and less attack surface) and private (don't have malicious components like keyloggers).

Yup, I belive this fixes the issue with the potential malicious javascripts. not relevant to Bitwarden but: if one wants also to avoid keyloggers and other malicious stuff in firefox addons, they should just use the Addons with the recommended Badge on them (covers pretty much every aspect, like donwloading Youtube videos, Blocking ads, sticky notes, etc..). These will always be checked by mozilla developers, each update for their source code as well. So they would be secure (less vulnerabilites and less attack surface) and private (don't have malicious components like keyloggers).

👍 1

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#2329