Now, most of the people who interact in this sub seem more tech literate on average, so we probably don't have to worry about being caught up in such a scandal, but I do worry for people who are less discerning potentially stumbling upon a malicious client app and losing their entire vault to it. Could even add a few features to make it seem like it's just a well-intentioned fork. and let the data from unsuspecting users roll in. Put it up on the Play Store, browser extension stores, etc.
Given that BW is open source, it probably wouldn't be difficult to spin up a fake client or app that steals your master password or all your vault data once it's been decrypted.
I think this is the most relevant threat, at least for the foreseeable future.
I guess the real issue would be how possible would it be to produce compromised browser addons and mobile apps. Android autofill can be finicky, depending on your phone. Automatic prompts on new logins is somewhat lacking. The one thing about Bitwarden is many people complain about the user interface. Their premium tier ($10/year) is about a third the price of their competition. It is completely usable as a free offering. This should give you more confidence they aren't sending your secrets to the Chinese government.īitwarden is cheaper than its direct competitors. The Bitwarden cloud storage ensures that I always have a up-to-date backup of my vault.īitwarden is open source and reviewed regularly by outside security consultants. (LastGasp is in a bad way because we now know their encryption is crap.)Īlso, the second threat to your vault is losing it entirely. Attackers could copy the server data (as happened to LastPass recently), and my vault is still secure. The encryption will hold out longer than any of the secrets in my vault. Some people like KeePass because there is no cloud storage component.Īs a zero knowledge architecture, I do not feel there is a significant threat from Bitwarden holding my encrypted vault. Ok, in terms of security it is about as good as a cloud based password manager can be.
0 kommentar(er)
