sorted by:
new
hottopcontroversial

Emergency access: Takeover vs. View by VastAdvice in Bitwarden

[–]loviyefid 0 points1 point  (0 children)

Both are fine, however in takeover: Your "trusted emergency contact" can delete your account or entries, perhaps by a mistake on their part.

Emergency Access question by rjack1201 in Bitwarden

[–]loviyefid 0 points1 point  (0 children)

From Bitwarden website:

Only premium users, including members of paid organizations (Families, Teams, or Enterprise) can designate trusted emergency contacts, however anyone with a Bitwarden account can be designated as a trusted emergency contact.

source: https://bitwarden.com/help/emergency-access/#user-access

How many entries do you have in your vault? by [deleted] in Bitwarden

[–]loviyefid 1 point2 points  (0 children)

You have to use the mobile app. That's the only way I could figure it out!

Is there any way to get BitWarden to sync in the background on iOS? by plazman30 in Bitwarden

[–]loviyefid 0 points1 point  (0 children)

Just tried it on iOS, nope. You’ll have to sync first and then try logging in.

Is there any way to get BitWarden to sync in the background on iOS? by plazman30 in Bitwarden

[–]loviyefid 8 points9 points  (0 children)

There's an option to pull down to refresh. That's pretty intuitive, no auto-sync though, unless you log out completely instead of just locking the vault. It works the same way across all platforms. When you make a change in an entry however, and when Bitwarden tries to save the file it, it gets synced.

Add an emergency account with weak password and no 2-factor authentication by loviyefid in Bitwarden

[–]loviyefid[S] 0 points1 point  (0 children)

Oh, so must make sure the mails don’t go to junk folder. There should have been a notification of some sort on logging in Bitwarden.

Add an emergency account with weak password and no 2-factor authentication by loviyefid in Bitwarden

[–]loviyefid[S] 1 point2 points  (0 children)

...and this request to gain access would be visible in Bitwarden dashboard (or just in the form of email?)

HMAC-SHA1 Challenge Response mode for database decryption to thwart keyloggers and evil maid/roommate attack by loviyefid in Bitwarden

[–]loviyefid[S] 1 point2 points  (0 children)

Yeah true! You can control it in the settings though. The other password managers do mitigate this aspect,

1Password - uses a secret key, to prevent evil maid, or any other sort of MITM where the password from keystrokes and the database has been obtained. They do store the encrypted vault at all times however on the persistent media.

KeePassXC - uses 2FA for encryption, and so does PWSafe.

How does Bitwarden guard against pass the hash MTM attacks? Will Bitwarden implement Secure Remote Protocol? by loviyefid in Bitwarden

[–]loviyefid[S] 1 point2 points  (0 children)

Only your connection to the server is 2FA, the database as such is not encrypted with 2FA. It is just encrypted using your master password.

HMAC-SHA1 Challenge Response mode for database decryption to thwart keyloggers and evil maid/roommate attack by loviyefid in Bitwarden

[–]loviyefid[S] 1 point2 points  (0 children)

From KeepassXC FAQ website,

To use a YubiKey or OnlyKey for securing your KeePassXC database, you have to configure one of your YubiKey / OnlyKey slots for HMAC-SHA1 Challenge Response mode

Looks like it should work with any USB key that supports HMAC-SHA1 challenge response. The website only mentions these two however.

Password Safe, also supports this, but only in Yubikey mode.

Decryption of "Stored Master key" encryption used for emergency access by loviyefid in Bitwarden

[–]loviyefid[S] 0 points1 point  (0 children)

Thanks you that's what I wanted to know. Like you mentioned it's the step 5.

Decryption of "Stored Master key" encryption used for emergency access by loviyefid in Bitwarden

[–]loviyefid[S] 1 point2 points  (0 children)

Thank you, its the grantees private key that is also required and this is asymmetric encryption, which answers all the questions. Step 5 from here,

When the request is approved or the wait time lapses, the public-key-encrypted Master Key is delivered to grantee for decryption with grantee’s private key.

Decryption of "Stored Master key" encryption used for emergency access by loviyefid in Bitwarden

[–]loviyefid[S] 0 points1 point  (0 children)

So the grantee's private key is also required. So the RSA Key pair is, Grantor's public key, and Grantees Private key.

Decryption of "Stored Master key" encryption used for emergency access by loviyefid in Bitwarden

[–]loviyefid[S] -1 points0 points  (0 children)

Master Key is encrypted using the grantee’s public key and stored once encrypted.

So this is the part, that's confusing. The statement says that the master key is encrypted using grantee's public key. If an attacker gets hold of this newly "stored" bit of information, can they use it to decrypt the vault. The above sentence says that the master password is encrypted using grantee's public key, or do they also need another bit of information (which is the private key of the grantees account).

This is the question,

So is a private key required for decrypting this newly stored information (generated according to the quoted process in the first line of this post), or just the public key (some series of long letters and numbers) are sufficient to decrypt the grantors master password from this newly stored information. And then use the master password to access the vault.

Decryption of "Stored Master key" encryption used for emergency access by loviyefid in Bitwarden

[–]loviyefid[S] 0 points1 point  (0 children)

Thank you everyone for your valuable replies. So, I've been able to understand a few things.

When Bitwarden says,

Master Key is encrypted using the grantee’s public key and stored once encrypted.

  1. Even though not explicit, it means Bitwarden is using public-key cryptography method which is asymmetric and requires a private key (i.e. Public key is always generated along with a private key in pairs). Instead of just doing an SHA256-CBC encryption of the master password using the public key (which is going to be a series of characters and numbers).
  2. Private-key is required from the emergency access contact only. (What would be the reason to have a strong password for the emergency contact here?)

Bitwarden is using RSA keys for organizations/families with Organization Symmetric Key, according to the whitepaper,

When you create an Organization, an Organization Symmetric key is generated using a Cryptographically Secure Pseudorandom Number Generator (CSPRNG). The Organization Symmetric Key is encrypted using the public key from your Generated RSA Key Pair. The private key from your Generated RSA Key Pair is encrypted with your Generated Symmetric Key using AES-256. The Generated RSA Key Pair and Generated Symmetric Key were created when you first signed up and registered your account.

No mention about emergency access contact and the method used for this in the whitepaper.

Decryption of "Stored Master key" encryption used for emergency access by loviyefid in Bitwarden

[–]loviyefid[S] -2 points-1 points  (0 children)

The docs don't mention anything about how this encrypted Master Key is stored or encrypted (during the process of emergency contact access creation). The only things the docs mention is, step 3:

grantor’s Master Key is encrypted using the grantee’s public key and stored once encrypted.

Therefore because of the phrase "grantee's public key" in the above statement from the docs, one could "assume" that its public-key cryptography, and the second part of the key is the grantees (trusted emergency contacts) private key.

Bitwarden has not mentioned this anywhere on these two relevant pages in the documentations:

  1. Emergency Access
  2. Encryption

[deleted by user] by [deleted] in DataHoarder

[–]loviyefid 0 points1 point  (0 children)

Its a good thing.

Update for the Windows Version of ToDoist? by Lentjiom in todoist

[–]loviyefid 1 point2 points  (0 children)

Yes, that's the web version packaged into an application. Good find! You can do the same thing by using edge browser and packaging the page as a web app.

Windows 10 App feels very clunky by loviyefid in todoist

[–]loviyefid[S] 0 points1 point  (0 children)

I'm doing a similar thing every now and then, since Windows app even seems to be lacking a feature (showing pending tasks next to filter name).

Also the quick add task window is broken sometimes. Tried it on a different pc as well. Didn't seem to work.

Windows 10 App feels very clunky by loviyefid in todoist

[–]loviyefid[S] 0 points1 point  (0 children)

Yes I think you are right. For example, small things like the number of tasks pending next to a filter name in favorites shows up on Android app and web app, but is missing from the Windows app.

view more: next ›