mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-02-05 00:29:40 +03:00
security against memory attacks? #236
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @pdarcos on GitHub (Feb 21, 2019).
Hi everyone,
Great project.
Has anyone read the latest report regarding password managers all being vulnerable to reading password in memory? https://www.forbes.com/sites/kateoflahertyuk/2019/02/20/password-managers-have-a-security-flaw-heres-how-to-avoid-it/
I wonder how bitwarden/bitwarden_rs would fare in this audit. Anyone have any more info?
Cheers
@mprasil commented on GitHub (Feb 21, 2019):
I think this question needs to be asked upstream. We use upstream code for the client side.
Server itself (which is what
bitwarden_rsdoes) only handles already encrypted data, so there isn't much to leak.@mprasil commented on GitHub (Feb 21, 2019):
I'm going to close this, but feel free to reopen if you think this question is still relevant for some reason.
@dani-garcia commented on GitHub (Feb 21, 2019):
To add some extra info, all the clients have an option to auto-lock the vault that should remove the master pass from RAM. Other than that and using 2FA, there is no other solution, really. If an attackere has control of your devices you've already lost.
@pdarcos commented on GitHub (Feb 21, 2019):
@dani-garcia That's what I was thinking too.
Thanks for confirming. I've opened up a ticket in the BW repo about this since it is an upstream client side vulnerability. https://github.com/bitwarden/browser/issues/876
Cheers