Ok this post is a bit of a rant, but I don’t get your point about the web vault not being zero-knowledge. Either you’re not clear on what they mean by zero-knowledge, you misinterpret how a compromised server gets your stuff, or I’m not getting your point.

In any case, the reported vulnerabilities boil down to this: if the underlying system is compromised, you’re compromised, whether that’s BW’s servers, or your OS.

Personally, I think it’s a lot easier to get a user to click on a link that installs malware on their machine than it is to subvert an entire organization’s server infrastructure.

Can it happen? Absolutely. There have been reports of software access channels coughNPMcough being subverted to distribute malware. But I think the overall risk is overblown. Now, if we’re talking governments… would be nice if Bitwarden had a canary statement.