• 0 Posts
  • 5 Comments
Joined 1 year ago
cake
Cake day: June 19th, 2023

help-circle


  • The main difference is that 1Password requires two pieces of information for decrypting your passwords while Bitwarden requires only one.

    Requiring an additional secret in the form of a decryption key has both upsides and downsides:

    • if someone somehow gets access to your master password, they won’t be able to decrypt your passwords unless they also got access to your secret key (or one of your trusted devices)
    • a weak master password doesn’t automatically make you vulnerable
    • if you lose access to your secret key, your passwords are not recoverable
    • additional effort to properly secure your key

    So whether you want both or only password protection is a trade-off between the additional protection the key offers and the increased complexity of adequately securing it.

    Your proposed scenarios of the master password being brute forced or the servers being hacked and your master password acquired when using Bitwarden are misleading.

    Brute forcing the master password is not feasible, unless it is weak (too short, common, or part of a breach). By default, Bitwarden protects against brute force attacks on the password itself using PBKDF2 with 600k iterations. Brute forcing AES-256 (to get into the vault without finding the master password) is not possible according to current knowledge.

    Your master password cannot be “acquired” if the Bitwarden servers are hacked.
    They store the (encrypted) symmetric key used to decrypt your vault as well as your vault (where all your passwords are stored), AES256-encrypted using said symmetric key.
    This symmetric key is itself AES256-encrypted using your master password (this is a simplification) before being sent to their servers.
    Neither your master password nor the symmetric key used to decrypt your password vault is recoverable from Bitwarden servers by anyone who doesn’t know your master password and by extension neither are the passwords stored in your encrypted vault.

    See https://bitwarden.com/help/bitwarden-security-white-paper/#overview-of-the-master-password-hashing-key-derivation-and-encryption-process for details.



  • wols@lemm.eetolinuxmemes@lemmy.worldExpert
    link
    fedilink
    arrow-up
    10
    ·
    1 year ago

    Oh neat, a real whoosh in the wild, on Lemmy!

    On a more serious note, vim is one of the most initially unintuitive commonly used pieces of software I’ve encountered.

    Sure, if you put in a little time and learn it, it’s not rocket science. But that seems like a weird standard for an essential tool used for one of the most common computing tasks of today.

    In response to your initial question, obviously it’s a meme. But like most good memes, it’s born out of a common* human experience. What do you think is the most common reaction when someone is thrown into vim for the first time? My guess is “what’s this?” or something similar, followed very soon by “how do I exit this?”. And the answer is, by modern computer users’ standards, quite arcane.

    IF you are somewhat familiar with the Linux terminal, you’ll try CTRL+C and IF you’re paying close attention you will notice that vim is giving you a hint. But if it’s your first time interacting with vim, chances are at least one of those conditions is not met. So now you’re stuck. And after an optional small moment of panic/disorientation, you google “how to exit vim” (provided you were at least lucky enough to notice/remember what program you’re in) => a meme is born.

    Exiting vim is almost like a right of passage for fresh Linux enjoyers. It’s not a hard task but it can seem daunting at first encounter, which is humorous given that quitting a program is normally such an easy thing to do.

    One more note, there is a group of people who will encounter vim quite unexpectedly and unintentionally: Windows users performing their first commit using git bash. They won’t even know they’re in vim, they’re dropped directly into edit mode and there’s no instructions for confirming the commit message, much less how to exit/cancel the operation.