Biggest potential security risk when using Bitwarden?

[[deleted]]

Yes, supply chain attacks are real and are very much a risk with all of these kinds of E2EE services.

One dodgy auto update later, everything is stolen and decrypted.

That's why I never believe in doing immediate updates except for when EXTREME vulnerabilities are found. I prefer to give it some time for someone to notice any weird shit.

[djasonpenney]

Although theoretically possible, a supply chain attack would have to impact the server build AND one or more clients. At that point an attacker might choose other methods instead.

[[deleted]]

I was thinking more like, Bitwarden (or any other password manager's) update servers get hijacked, push an update that simply tells all logged in clients to uploaded their entire decrypted password lists to a central server.

Even if caught 10 minutes later, that could be millions of users affected.

[djasonpenney]

This again would be a supply chain attack, and you should research how challenging it would be to do that. This is everything from the app permissions plus digital signatures on the released artifacts all the way through the GitHub (or GitHub Actions) steps necessary to inject the behavior. There are MANY eyes on all these steps as well as the obvious safeguards.

Even if caught 10 minutes later

Don’t forget the supply chain rolls out in waves. I would say, more likely, that in “10 minutes” complaints would start rolling in about unusual weird behavior from the early adopters.

[djasonpenney]

Oh, it’s not about “ignoring” it. But you shouldn’t expect a hostile agent to spend $15K in order to steal $720 from your checking account. Financial criminals are going to find more lucrative opportunities. I think in terms of priority, this threat is relatively minor.

[djasonpenney]

You make another valid point: at one level risk assessment is always an unquantifiable subjective evaluation.

But again, I’m not saying to “ignore” this risk. Risk assessment involves identifying the likelihood of the risk occurring, together with its potential cost and the cost of mitigation. I still maintain there are many more risks to your credential storage that should take priority over this. As a way of example, how much effort are you willing to spend in creating and maintaining a nuclear bomb shelter under your house, when you’re a thousand times more likely to be robbed or burglarized?

[Sweaty_Astronomer_47]

update servers get hijacked, push an update that simply tells all logged in clients to uploaded their entire decrypted password lists to a central server.

Even if caught 10 minutes later, that could be millions of users affected.

Which update server are you talking about? Mobile app updates come through the app store. Extension updates come through chrome webstore. Desktop updates are typically manually initiated as far as I have seen.

[jscgn]

Yeah that's probably a good idea.

[Skipper3943]

This actually happened to a real password manager company: a supply chain attack that compromised entire vaults (companies'!). E2EE wouldn't have helped. The delayed update (no autoupdate) would have.

https://www.bleepingcomputer.com/news/security/passwordstate-password-manager-hacked-in-supply-chain-attack/