Hacker News Reader

Comment by ROFISH | Hacker News Reader

Even more hilarious: I have recorded customer service events specifically stating against all three of those.

I liked 1Password when it was an amazing Mac-only app. Now it's just another Electron app I can throw away and discard for different Electron app, there's nothing special about it.

The problem is that I don't see any particular alternative. I don't like Bitwarden's security (password is provided to the server to partially unlock so a malware server or MITM could get the password) and LastPass has known issues.

EDIT: And standalone apps are neat and cool, but doesn't let me share the Netflix password with my family.

View on HN

> password is provided to the server to partially unlock so a malware server or MITM could get the password

That is completely false.

"The Master Password is cleared from memory after usage and never transmitted over the Internet to Bitwarden servers, therefore there is no way to recover the password in the event that you forget it."[0]

[0]: https://bitwarden.com/help/bitwarden-security-white-paper/

Bitwarden does some of the KDF operations server-side which means that a portion of the password (even if it's been through some KDF operations) is sent to the server.

EDIT: https://palant.info/2023/01/23/bitwarden-design-flaw-server-...

They send the hash of the master key password after it's been encrypted to the server. They then encrypt the hash on the sever side to auth you. They don't send the password itself.

What that article is saying (rightfully, mind you) is that an attacker can mostly ignore the server side round of encryption, because if they have a copy of your local vault, they can just perform the client side rounds and then see if they can decrypt the vault.

This is a problem mostly if you see their claims of 100000 rounds server side, and decide "oh that's fast enough, I'll drop the client side rounds to 5 so my vault is fast to open)"

> password is provided to the server

No, it’s not? I can unlock my offline vault with no internet access at all.

1password is pushing me more and more toward something else, it has only to piss me off a bit more and I might just drop down to Apple Keychain for most things ...

I really hope Apple sherlocks them this year and releases a dedicated “Passwords” app. They might, to push their new pw-less login and so on.

I went apple passwords only a while back and don’t really regret it. It works really well most of the time, with a couple of annoying “open up the settings app to get my password” moments.

If they ever take it seriously and release a dedicated app with iCloud family sharing I don’t think I would have a reason to look elsewhere.

>password is provided to the server

What is this you say?

https://palant.info/2023/01/23/bitwarden-design-flaw-server-...

So its not the password that is being provided, but an encrypted hash

Reply on news.ycombinator.com