xxkylexx

Thanks for the question. Sorry I couldn't get to these questions sooner as I have been overwhelmed a bit with all the questions and feedback rolling in.

PBKDF2 is an standard that is readily available in all the frameworks being used for this product. This is important because all products must be doing crypto the exact same way and this can be a bit of a challenge to keep in sync without a standard. I am also attempting to keep my third-party library exposure to a minimum when it comes to crypto functions. I realize that PBKDF2 is a pretty old function, however, I am not aware of any risks in using it as long as iteration levels are properly increased over time.

AES256-CBC is used because it provides the level of crypto that is needed for this type of application. I realize that CBC lacks the integrity checks that other methods may offer, however, I am not sure integrity is needed to still provide a secure exchange of ciphers from a trusted source as is being done here.

Crypto is only done in Javascript for the the website and browser extensions. Maybe I am not understanding your question here fully, but I am not sure of any other way to handle Crypto on the client side for these environments. For the mobile products, crypto is being done using local CommonCrypto (iOS), BouncyCastle (Android), and .NET.

I hope this answers your questions and thanks again for having a look!

Thanks for the feedback! I agree that the whole site model may have been taken too far. I have plans for adding other "types" that will support other models. As a first simple step, we can add a free-form notes entry that you can put in whatever you want along with a descriptive name.

For android, there is a issue that is being tracked for adding autofill support. iOS already supports this, I just did not have time to get it in for the 1.0.0 release on Android (see https://github.com/bitwarden/mobile/issues/1). Also, I am an iOS user so I do not have a lot of experience with how android "should work" so that makes things a bit slower for me doing development there.

This primarily just comes from my love for the language/framework and long professional history and expertise of using it for building web applications.

Thanks! Building mobile apps was actually a first for me with this project (my background is in .NET & web development).

This is an ASP.NET Core application, however, it references the full .NET Framework currently (instead of .NET Core which is full cross platform). I am working to make it run on .NET Core but it requires some third party library dependencies to be addressed first. This is being tracked here https://github.com/bitwarden/core/issues/3 . I anticipate this to run on .NET Core in the near future and therefore be truly cross platform for Windows, Mac, and Linux.

I will answer this question in a bit when I have some more time.

I had a feeling people might make a fuss about this. I am really just using it to learn about how the product is being used at the moment since it is so new and I would like to improve the experience for people. I have intentions on adding an opt-out flag in settings for this.

Thanks!

Thanks. I reached out to the email listed in the guidelines.

Unfortunately I can only support the ARM64 architecture for iOS currently due how Xamarin builds the project. When I introduce additional architectures (i.e. ARMv7) it increases the size of the app from 50mb to 100mb.

Did my comment get flagged for spam or something? Not sure what you mean by "marked as dead".

Hi all. I am the author of this project if you would like to ask any questions. Many have been answered on Reddit already but I will participate here as well. You can view the project source at https://github.com/bitwarden or the main product website at https://bitwarden.com/