Hacker News new | ask | show | jobs
by CtrlAltT5wpm 2639 days ago
I'm in the same boat you are. I'm considering alternatives to Lastpass, mostly because the client has gotten worse over the past few years (since they were picked up by LogMeIn). I don't mind price hikes, but I don't feel as if I've gotten a commensurate increase in the utility or smoothness of the application (though I've certainly noticed an uptick in bugs).

My big thing is the integration of the Yubikey, which is almost mandatory. Bitwarden has this, but their recent security assessment had a showstopper, as far as I'm, concerned:

'BWN-01-010 – Changing the master password does not change encryption keys'

https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assess...

If Bitwarden gets that fixed, I'd jump ship instantly. Otherwise, I may play with Firefox Lockbox and see where that gets me.

1 comments

> Resolution

> An option to rotate the encryption key and mac key has been added to the change password operation. Rotating the keys will generate new, random key values and re-encrypt all vault data with these new keys.

Thanks for that. Some of the news sites I had been reading had neglected to mention this (and to be fair, I neglected to catch it) this, and I could swear some had reported that Bitwarden had claimed that this was a difficult issue to solve, and would likely not be implementing it in the near future. Information overload, I guess.