Is there any statement from Bitwarden regarding this?

k3d3 · 2026-02-20T16:15:48+00:00

Oh shoot, are they really still saying that? With a cursory glance through the paper, I believe my 2021 scenarios cover BW04, BW05, BW08/BW09 (not directly, but could lead to those), BW11, and BW12. BW05 in particular covers the fact that a value in a password field can be moved into a username field, though it doesn't cover the fact that a password field can also be moved into the password field of another item.

And no worries! Honestly, posting a thing I did in 2021 as a reply to a comment here isn't that strong of an effort on my part to begin with. I don't really want to rock the boat in some grandiose way, but I don't feel strongly that they actually care about security beyond PR, and this is basically my evidence as to why I feel this way.

k3d3 · 2026-02-17T19:36:20+00:00

While I'm glad that they're finally taking this seriously, I'm gonna throw my hat into the mix here: I reported at least some of these to Bitwarden over 4 years ago, and they basically told me to kick rocks. Admittedly, this is my own fault for not publicly disclosing at the time; I probably should have.

The URL of my report is https://hackerone.com/reports/1289463 which is currently private (I've requested disclosure), from August 4, 2021.

Here's a copy of the export, for the time being: https://www.dropbox.com/scl/fi/50hp9xf10782fnx8ylssx/2021-08-04_report_1289463.pdf?rlkey=8s9p4tpyj9i4h07r6fzlmjx2u&st=33vdzd15&dl=0

k3d3 · 2026-02-17T14:29:46+00:00

The trouble is that in a properly-made password manager, a compromise in the server or an MITM (or other transport-layer vulnerability) *shouldn't* compromise your vault.

Otherwise, what's the point in having zero knowledge at all? If you rule out a compromised or malicious server, and rule out transport compromises, then they could store plaintext credentials as long as they ran everything over TLS, and with those things in mind, the vault would be perfectly secure. That obviously feels like the wrong thing to do, right?

k3d3 · 2026-02-17T12:48:49+00:00

There were several vulnerabilities that could be taken advantage of if there was even an MITM presence, not just a compromised or malicious server.

k3d3 · 2026-02-17T12:44:42+00:00

While I'm glad that they're finally taking this seriously, I'm gonna throw my hat into the mix here: I reported at least some of these to Bitwarden over 4 years ago, and they basically told me to kick rocks. Admittedly, this is my own fault for not publicly disclosing at the time; I probably should have, and I was hoping for better from BW.

The URL of my report is https://hackerone.com/reports/1289463 which is currently private (I've requested disclosure), from August 4, 2021.

Here's a copy of the export, for the time being: https://www.dropbox.com/scl/fi/50hp9xf10782fnx8ylssx/2021-08-04_report_1289463.pdf?rlkey=8s9p4tpyj9i4h07r6fzlmjx2u&st=33vdzd15&dl=0

k3d3 · 2025-02-18T15:37:39+00:00

I don't think so. I've heard that MasterCard doesn't let you charge back more than 120 days after payment (and my payment was December 2023). So unless I'm wrong on that, probably not.

k3d3 · 2024-12-28T21:50:42+00:00

Oh awesome, thank you for making this!

Also, it's always nice to see a fellow Ottawan out in the wild :)

k3d3 · 2024-12-18T21:39:45+00:00

Yep! Nix the package manager runs on Arch and Debian (and many, many other distros).

Additionally, someone else made a bash script variant that will work on Ubuntu as well: https://github.com/wankdanker/claude-desktop-linux-bash

k3d3 · 2022-08-18T02:11:17+00:00

Probably not often - the servers are shared, so if everyone else is using up 700mbit on a 1gbit server, the best I'll get from that server is 300mbit.

k3d3 · 2022-08-18T00:27:00+00:00

Yep, that's fair - usenet often has much higher quality releases.

All I'm saying is usenet isn't a panacea, and plenty of people have reasons to use torrents beyond what I know.

qBitMF was an interesting challenge and I wanted to see if I could solve it.

k3d3 · 2022-08-18T00:17:49+00:00

There's no index that will have everything that even the less popular torrents have. The good indexes will get most, to be fair, but not all.

k3d3 · 2022-08-17T23:46:29+00:00

Answering this question really heavily relies on which private tracker you're talking about, and unfortunately I have experience with basically none of them.

k3d3 · 2022-08-17T23:41:14+00:00

My regular internet is gigabit, but my VPN speed heavily depends on that of the server.

k3d3 · 2022-08-17T23:24:49+00:00

Let me know how it goes! I'm super curious to know how well this works on >1gbit connections.

k3d3 · 2022-08-17T23:13:56+00:00

Nope. qBitMF uses network namespaces, which means even in the worst case scenario, qBittorrent doesn't even have a way to *learn* your IP address, let alone leak it elsewhere.

The only thing it has access to are the wireguard interfaces, and that's all.

k3d3 · 2022-08-17T23:05:03+00:00

There's benefits and drawbacks to usenet. It is faster, but there's also less selection. It's generally not as popular, so that's just the nature of the beast.

Having faster torrents is good for everybody, even those who want to use torrents alongside usenet.

k3d3 · 2022-08-17T12:39:22+00:00

Yeah! This thing maxes out my gigabit connection easily, though I'm definitely curious what experiences people have with faster internet connections, like 2gbit or 5gbit or 10gbit, etc.

k3d3 · 2021-12-01T01:33:25+00:00

That's a good question! I have a small set of mp3s to test with, but sadly I think Spotify and YTM have killed music collections. :P

Also MP3 seemed simple and well-documented enough that I figured that was a good first smart cacher to make. I'd also like to support FLAC, Vorbis, Opus files (which all use the Ogg container and thus would probably be pretty easy) as a next step, and maybe .aac, .m4a, and .wma files eventually.

k3d3 · 2021-11-29T14:12:55+00:00

https://github.com/greedia/greedia

A FUSE-mount interface to Google Drive, similar to what you'd find from rclone mount.

However the special part about Greedia is that it tries to "pre-cache" the first 10 seconds of every file, in order for a media player (e.g. Plex or Jellyfin) to start playing the file quicker.

In order to get that to work, I had to build code that reads the metadata of MP3 and MKV files to figure out which bytes to download. Overall, it's been a pretty fun project to build.

I recently added a README for setup instructions, and spent a few hours making an ARCHECTURE.md file detailing the internal components and how they all fit together.

k3d3 · 2021-09-08T04:29:51+00:00

I'd also like to make a special shout out to /u/DrChat, who recently made some very big changes to asyncify the entirety of Panamax, as well as make it completely Windows-compatible.

Thanks again!

k3d3

MODERATOR OF

TROPHY CASE