Bitwarden Heist - How to Break Into Password Vaults Without Using Passwords
blog.redteam-pentesting.de
Sometimes, making particular security design decisions can have unexpected consequences. For security-critical software, such as password managers, this can easily lead to catastrophic failure: In this blog post, we show how Bitwarden’s Windows Hello …

Bitwarden Heist - How to Break into Password Vaults Without Using Passwords::Sometimes, making particular security design decisions can have unexpected consequences. For security-critical software, such as password managers, this can easily lead to catastrophic failure: In this blog post, we show how Bitwarden’s Windows Hello …

  • jet@hackertalks.comEnglish
    4·
    8 months ago

    This is a great write up. I was expecting some gotcha, but step-by-step it all makes sense. Many layers of this onion

    "activating biometric login on Windows means that the derived key is encrypted locally using a secret which can be retrieved after authentication via Windows Hello. "…