• Lettuce eat lettuce@lemmy.ml
    link
    fedilink
    English
    arrow-up
    2
    ·
    27 days ago

    Lol, imagine ridiculing users for trusting an FOSS company to handle their password management, and then storing your encrypted password DB in Microsoft’s OneDrive 😆

    • net00@lemm.ee
      link
      fedilink
      English
      arrow-up
      0
      arrow-down
      1
      ·
      27 days ago

      I knew a comment like this was coming, but unless you can show how microsoft can decrypt my kdbx I stand fully by my current setup.

      • Lettuce eat lettuce@lemmy.ml
        link
        fedilink
        English
        arrow-up
        3
        ·
        27 days ago

        I don’t think Microsoft can decrypt your DB file, neither do I think Bitwarden can. Encryption happens locally on their open source clients too.

        But I’m not the one disparaging trusting an open source program to securely encrypt passwords, you are.

      • Bezier@suppo.fi
        link
        fedilink
        English
        arrow-up
        0
        ·
        27 days ago

        Could you please show how bitwarden can decrypt a vault that’s locally encrypted by a foss client?

        “Imagine trusting any company with your passwords”

        • Llewellyn@lemm.ee
          link
          fedilink
          English
          arrow-up
          0
          arrow-down
          2
          ·
          edit-2
          26 days ago

          They created the client. In theory, they can have some backdoors. And since you store your files on their side, risk is greater, imo

          • soul@lemmy.world
            link
            fedilink
            English
            arrow-up
            0
            ·
            edit-2
            26 days ago

            This is where your lack of understanding of the open source thing is readily apparent to everyone arguing with you. If it was backdoored, many people would be calling that out. In fact, this was one of the exact reasons at the heart of the original concerns leading to this story.

            The fact that the source is available means that we can see exactly how the data is encrypted, allowing assurances to be made independently.

            If nothing else, I trust Bitwarden MORE because of that and I’m happy to pay them for their services since it helps find further development.

            • Llewellyn@lemm.ee
              link
              fedilink
              English
              arrow-up
              0
              arrow-down
              1
              ·
              26 days ago

              If it was backdoored, many people would be calling that out.

              In theory. And not necessarily soon. Don’t forget the context of this thread: we compare bitwarden with keepass, which does not offer to you your password base on their server side.

              • kurcatovium@lemm.ee
                link
                fedilink
                English
                arrow-up
                2
                arrow-down
                1
                ·
                25 days ago

                Trusting one FOSS client good. Trusting different FOSS client bad. Logic where?

                • Llewellyn@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  arrow-down
                  1
                  ·
                  24 days ago

                  That different FOSS client stores your data on their company’s server. It’s an important factor, IMO.

                  • kurcatovium@lemm.ee
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    arrow-down
                    1
                    ·
                    24 days ago

                    Dude, how is bitwarden hosting your own, locally encrypted (in FOSS client) password database any different than using keypass and syncing it however you want?

                    I don’t even use Bitwarden myself, I’m using keepass too, but this attitude is … weird?