• howrar@lemmy.ca
    link
    fedilink
    English
    arrow-up
    3
    ·
    3 months ago

    What makes the built-in database easier to attack than a separate one?

    • rekabis@lemmy.ca
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      3 months ago

      What makes the built-in database easier to attack than a separate one?

      For performance reasons, early versions weren’t even encrypted, and later versions were encrypted with easily-cracked encryption. Most malware broke the encryption on the password DB using the user’s own hardware resources before it was even uploaded to the mothership. And not everyone has skookum GPUs, so that bit was particularly damning.

      Plus, the built-in password managers operated within the context of the browser to do things like auto-fill, which meant only the browser needed to be compromised in order to expose the password DB.

      Modern password managers like BitWarden can be configured with truly crazy levels of encryption, such that it would be very difficult for even nation-states to break into a backed-up or offline vault.

    • Telorand@reddthat.com
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      3 months ago

      It’s protected by the user’s login password. If an attacker can steal that or knows it already, the passwords are all there for them to see.

      Bitwarden (on the other hand, for example) has 2FA options to unlock the database.

      • orbitalmayo@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        How does this work if accessing Bitwarden via the browser extension? I don’t like needing to type my master password in all the time as it’s long, so I have the setting turned on that times the vault out periodically, but so it’s also unlockable with a pin rather than requiring the master password every time. I understand the pin is shorter, but does the protection of the vault still stand?

        • Telorand@reddthat.com
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          That’s a good question. I don’t actually know the answer to that. I know the passwords are hashed locally when your vault is locked and before being synced, but I’m not sure whether it’s in plaintext when it’s unlocked or if it uses some kind of on-demand decryption. It’s probably in their docs, I should think.

      • howrar@lemmy.ca
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        Oh, so you mean local vs external, not browser-based vs other local solutions.