mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2025-12-10 01:10:09 +03:00
security against memory attacks? #2181
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @pdarcos on GitHub.
Hi everyone,
Great project.
Has anyone read the latest report regarding password managers all being vulnerable to reading password in memory? https://www.forbes.com/sites/kateoflahertyuk/2019/02/20/password-managers-have-a-security-flaw-heres-how-to-avoid-it/
I wonder how bitwarden/bitwarden_rs would fare in this audit. Anyone have any more info?
Cheers
@pdarcos commented on GitHub:
@dani-garcia That's what I was thinking too.
Thanks for confirming. I've opened up a ticket in the BW repo about this since it is an upstream client side vulnerability. https://github.com/bitwarden/browser/issues/876
Cheers
@dani-garcia commented on GitHub:
To add some extra info, all the clients have an option to auto-lock the vault that should remove the master pass from RAM. Other than that and using 2FA, there is no other solution, really. If an attackere has control of your devices you've already lost.
@mprasil commented on GitHub:
I'm going to close this, but feel free to reopen if you think this question is still relevant for some reason.
@mprasil commented on GitHub:
I think this question needs to be asked upstream. We use upstream code for the client side.
Server itself (which is what
bitwarden_rsdoes) only handles already encrypted data, so there isn't much to leak.