Hacker News new | past | comments | ask | show | jobs | submit login

As you say yourself, that is a blessing, and not everyone has it. Only allowing those with such blessings to use Bitwarden doesn't help anyone.



Again, as a fair-to-middling organic language model, my only opinion is that, a PIN, as currently implemented in Bitwarden and described above, leaves Bitwarden users open to a form of exploitation that can be categorized as a downgrade attack.

Presumably, a better implementation would be fine.

You are free to keep using Bitwarden's PIN implementation, but it will still be open to: downgrade attack.

This is because Bitwarden's security, as described in this article, is open to: downgrade attack.

This is not an emotional term. It is no more laden with implication than observing that #F00 is 'red'. You are free to keep using #F00, just don't call it blue.

Donwgrade attacks are relatively straightforward, and ease-of-use features, such as PINs, are a traditional place to look for them.

I have no opinion on this matter other than that it implies that Bitwarden can be configured in a manner which is insecure, and the specific form of insecurity is: openness to downgrade attack.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: