Hacker News new | ask | show | jobs
by SV_BubbleTime 1087 days ago
BW now uses Argon2 over PBKDF. I can’t remember if that is by default, opt-in, or new accounts. But barring an argon vuln, this is even less of a concern.

Also, I think BW has been using more than 100k for some time now. Last I saw 600K was the recommendation.
1 comments
emaciatedslug 1087 days ago
The default for new Bitwarden accounts from Feb 2023 on is PDBFK2 HMAC SHA 256 setting at 600,001 iterations on the client and 100,000 on the server with the option to use Argon2id. These settings are above current OWASP recommendations. https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor... https://bitwarden.com/help/kdf-algorithms/
link
NoZebra120vClip 1087 days ago
All the replies have given random statistics, but these don't shed much light on the length of time it may take an attacker to brute-force a password, or find a chink in the armor of the vault's encryption algorithm.

Now as I said, a significant threat actor with lots of time in their future plans can collect encrypted stuff such as vaults and bide their time. Someday, the decryption may be cost-effectively cheap. Someday, a flaw may be uncovered in the cryptography. Someday, a vault owner's secret key(s) may leak and can be correlated.

As I said, it's just a question of time, and the ability to hold on to your cards for long enough that they can be played in the proper manner. It may take 5 years, 10 or 20, but if the payoff is valuable enough, it's worth the wait for the threat actor.

link
SV_BubbleTime 1087 days ago
There is practically zero scenarios where hacking ANY bitwarden account 20 years from now nets you anything useful.

If the concern is general encryption when you were concerned about a 20 year from now scenario, don’t send it.

link
NoZebra120vClip 1085 days ago
> There is practically zero scenarios where hacking ANY bitwarden account 20 years from now nets you anything useful.

Bitwarden is a password manager, yes? What about cloud accounts of someone's employer, like an AWS account that runs $1,000,000 of monthly assets? That wouldn't be valuable in 20 years?

What about VPN credentials for some big tech intranet? Yeah, hopefully they use MFA and they expire passwords before 20 years, but just in case, right?

I can certainly see nation-state actors hanging on to juicy encrypted password manager vaults, just on the off-chance they could hit the jackpot. I can think of plenty of accounts that would still be valuable and enabled 20 years from now.

link
SV_BubbleTime 1085 days ago
Twenty years ago we had Windows XP.

You think AWS accounts are going to have a simple password requirement in the same time?

You don’t think twenty years from now that everything is a multifactor / immutable likely-bio hardware key?

link