• 0 Posts
  • 93 Comments
Joined 2 years ago
cake
Cake day: November 23rd, 2023

help-circle














  • “Properly implemented” is doing the heavy lifting in that sentence.

    Four paragraphs down from your quote is this:

    Their attacks ranged from integrity violations affecting specific, targeted user vaults to the complete compromise of all vaults within an organisation using the service. In most cases, the researchers were able to gain access to the passwords – and even make changes to them.

    If E2EE were properly implemented, the above would be impossible.


  • This is what Bitwarden claims to do, and yet we have a paper showing that with a compromised server there exists a vulnerability:

    Their attacks ranged from integrity violations affecting specific, targeted user vaults to the complete compromise of all vaults within an organisation using the service. In most cases, the researchers were able to gain access to the passwords – and even make changes to them.



  • Sure, but at the end of the day even if you don’t update your vaultwarden server or you rely on an insecure storage sync system like dropbox, your actual vault is encrypted with a key that only you know. Even if your server is hacked or the kdbx is leaked, your passwords are safe until someone breaks AES.

    Contrast that with hosted services, who could very easily attach their own keys to your encryption key (whether now or in the future at the behest of the state) and you’d be none the wiser. E2EE doesn’t matter much when the other end is controlled by someone else.

    I’m not disagreeing that most people just want something to work without thinking about, and for that reason I’m glad that services like bitwarden and lastpass and protonpass exist. My intent was not FUD, just shining a light on the fact that keeping your passwords secure does not require trusting a company.


  • tl;dr:

    1. If the password manager server is hacked and compromised, then syncing your passwords with the compromised server will lead to compromised passwords (duh)
    2. None of the providers tested have (or have had in the past) compromised servers.

    and an observation or two:

    • Vaultwarden is free, self-hostable, and doesn’t rely on trust in a third party.
    • Keepass (and its client variants, like KeepassXC which is pretty great) is even more secure because there is no server, just an encrypted file you can store anywhere.