[HN Gopher] Bitwarden Send - A trusted way to securely share inf...
___________________________________________________________________
Bitwarden Send - A trusted way to securely share information with
anyone
Author : 0x54MUR41
Score : 503 points
Date : 2021-03-12 09:29 UTC (13 hours ago)
(HTM) web link (bitwarden.com)
(TXT) w3m dump (bitwarden.com)
| bearbearbear wrote:
| Any time you see an advertisement for a product whose primary
| function is "hey give us your super secret stuff, we totally
| won't do anything evil with it," you should assume that the
| vendor is going to do something evil with it.
| justathroway77 wrote:
| I recently (2 days ago) had an attempted login into one of my
| accounts. The password was randomly generated by bitwarden and
| not reused anywhere. Luckily I had 2fa which alerted me to the
| attempt. This is beyond puzzling to me as there is no possible
| way someone could have guessed or downloaded this password from a
| DB leak. Can anyone suggest what this could be? (The attempt came
| from a country that is not my own)
| Snawoot wrote:
| Maybe your local system is compromised? I don't see much of
| other options.
| tim333 wrote:
| I just tried it. Here's one saying Hi HN:
|
| https://send.bitwarden.com/#aSBOPtnJT0qjwqzpAOZM_w/Moum7wc6k...
| julianlam wrote:
| Is that a phishing link?
|
| Are you going to follow up with a company-mandated training
| seminar on not clicking random links on the internet? ;)
| tim333 wrote:
| Well you can check the link is bitwarden.com but I guess in
| the message I could have said something iffy.
| tim333 wrote:
| Update - I see the similar Firefox Send was closed down due
| to people putting iffy stuff (phishing, malware) in the
| messages.
| Spivak wrote:
| Running a public service like this is a genuine
| commitment to fight spam, malware, phishing, cp, and
| various other oogy boogies simply because if you don't
| people will take advantage and your links will start
| getting flagged as sketchier and sketchier. It's a hard
| laborious problem to solve when you have to prevent and
| suss out bad content while also not being able to see it.
| Bitwarden is gonna be leaning hard into the account
| requirement and the reputation of the sender.
| surround wrote:
| So the decryption key contained in the url after the "#"? Is it
| never sent to the server, and instead only used to decrypt the
| message in-browser?
| selykg wrote:
| Right, anything after the # is not sent to the server, like
| other anchors.
| tim333 wrote:
| I wonder how they know which message. I guess javascript on
| the client reads the stuff after # and sends something
| derived from it to the server?
| selykg wrote:
| So I created a test Send:
|
| https://send.bitwarden.com/#j_2g_Uin5kuwZazpASDD2w/vhzdAz
| IS3...
|
| https://send.bitwarden.com/#VGacXlwPhUSVHKzpASEAyg/VrzFu9
| aUf...
|
| So, it looks like it's pretty simple.
|
| After the # you have two separate things, separated by /
|
| One is an identifier, the other is likely an encoded key
| (that may or may not depend on a separate password, if
| specified).
|
| Just a guess, I assume this is documented somewhere
| tyingq wrote:
| More detail: https://bitwarden.com/help/article/about-send/
| dethos wrote:
| Interesting, it seems to work very similarly to Firefox Send.
|
| For communications in the other direction, such as when you want
| to make sure the other person sends you the content securely,
| there is https://github.com/whitesmith/hawkpost (disclaimer, this
| was an hackathon project I participated some years ago). Hawkpost
| doesn't even store the encrypted content.
|
| I wonder if there is a solution that would correctly deal with
| both situations (never requiring the other end to sign up or know
| anything about encryption).
| timvisee wrote:
| By the way, Mozilla's Send is down, but I'm maintaining a fork
| with a public instance. :)
|
| https://send.vis.ee/ (https://github.com/timvisee/send)
| mushufasa wrote:
| That is very neat!
|
| That said, I think a lot of the value of Firefox Send, which
| I used a bunch, was that it was maintained by a trusted brand
| in Mozilla. Indie groups won't have that reputation. And if I
| wanted to self-host, I would just use magic-wormhole.
| timvisee wrote:
| Definitely. But many still use it, partially because of
| `ffsend` (https://github.com/timvisee/ffsend), so it's nice
| to have around.
| haunter wrote:
| Do you have any problem with spam? Afaik that was one of the
| main issue why Mozilla shut down the service originally, it
| was _too good_
| timvisee wrote:
| Not that I know of. Got a DMCA only once.
|
| Mozilla's instance was obviously associated with the big
| names 'Mozilla' and 'Firefox' which made it easy to abuse.
| That isn't an issue now. I guess that helps.
| GraemeMeyer wrote:
| The Mozilla one was being used to deploy malware, so you
| should watch out for that in advance. Frankly, I don't
| know how though, and I think Mozilla couldn't figure it
| out either -that's why it was shut down instead of fixed
| prophesi wrote:
| This is really clever. And looks like it's easy to self-host
| via Docker.
|
| > I wonder if there is a solution that would correctly deal
| with both situations (never requiring the other end to sign up
| or know anything about encryption).
|
| I'm actually in the midst of building out a tool for that exact
| scenario[0]. You can send it to anyone so long as you know the
| email or username they use for a service that implements OAuth.
| If they successfully authenticate and the server sees their
| username / email match up, it sends back the encrypted data to
| the frontend, which then decrypts it with the key in the URI
| fragment. It's neither audited nor open source just yet, so I
| don't recommend using it for actual secret sharing until then.
|
| [0] https://intended.link/
| RussianCow wrote:
| This is a fantastic idea! Bookmarked. Is there a GitHub repo
| of this? I would be more than happy to contribute some PRs.
| prophesi wrote:
| There hopefully will be one soon! The backend was written
| haphazardly in a weekend, so once I clean it up to save
| myself some embarrassment, I'll open up the source on
| Github. I'll send you an email if that happens (using the
| one in your HN profile).
| garettmd wrote:
| Thanks for the link to Hawkpost, it looks really cool!
| hathym wrote:
| you might also be interested in https://github.com/magic-
| wormhole/magic-wormhole
| fernandotakai wrote:
| one of my favorite tools, i just wish there was a good GUI
| for it.
| Klonoar wrote:
| I've been building a Rust macOS app for it, actually -
| could use testers in a week, I think. Let me know if
| you're interested?
|
| https://twitter.com/ryanmcgrath/status/136802746906896384
| 3/p...
| psanford wrote:
| Have you tried this? https://github.com/Jacalz/wormhole-
| gui
| bj0 wrote:
| There's a webapp version (clone?) of it:
| https://webwormhole.io/
|
| There's also a nice go port (single binary) of it:
| https://github.com/schollz/croc
| mhdhn wrote:
| I not NOT get why the demo'd and encouraged way of sending is
| considered secure. The email is not encrypted. It contains a link
| in plain text. It's not stipulated that secure email servers
| (TLS) are used, and if non-secure, the plain text of the link
| could potentially be sniffed out by anyone with access to one of
| the nodes along the chain of transmission of the email data.
| Further, if the email server on either end is gotten to, the URL
| is sitting there in plain text, so the attacker has it.
|
| Now, once you have the URL, you have direct access to the secret
| info, without any challenge.
|
| Modulo this method making it possible to shorten the time the
| info is available, and to take the info away after the info has
| been accessed, what is secure about this?
|
| Couldn't you have the same effect essentially by sending the
| secret through email and then mutually agreeing on both sides to
| delete the email message immediately after sending (by the
| sender) and receiving (by the receiver)?
| justusthane wrote:
| Probably the best thing to do is set the access count limit to
| one. That way, no one else will be able to access it after the
| intended recipient does. And if a 3rd party accesses it
| _before_ the intended recipient, then the intended recipient
| will not be able to access it and at least you 'll have an
| indication that it was intercepted.
| DistractionRect wrote:
| > Add a password to further protect the Send
| egem wrote:
| which you must again share with the recipient but how?
| Corrado wrote:
| It's turtles all the way down!
| dartharva wrote:
| You'd think such a thing should have been directly implemented in
| Chat apps and related communication channels long ago considering
| how much demand there is in the industry, but nope. Signal is the
| only one among popular texting apps that implements disappearing
| messages correctly.
| jgtrosh wrote:
| What makes you say that Telegram doesn't?
| dartharva wrote:
| I honestly didn't know Telegram had that feature, even though
| I've been using it for nearly a year.
|
| Stand corrected now, thanks.
| skrowl wrote:
| Telegram deleting messages appear to work for me. Likely this
| guy is just buying into Signal FUD that Telegram is somehow
| worse encryption, despite Signal's encryption being used by
| Facebook and funded by the US Govt.
| ziddoap wrote:
| What does using the same encryption algorithms of a
| government or business have to do with the conversation?
| Are you implying that the algorithm is unknowingly back-
| doored, with the evidence being that Facebook uses the same
| algorithm? Or am I misunderstanding your point?
| kissickas wrote:
| The claim isn't that Telegram's encryption is worse, it's
| that Telegram's closed-source backend is unauditable.
|
| Your other points are a great example of FUD.
|
| edit: changed clients to backend
| zwog wrote:
| I think Telegram clients are open source, aren't they?
| kissickas wrote:
| You're right, edited. Thanks!
| wtmt wrote:
| For all practical purposes, Signal's backend is also
| closed source. The public repository for the server code
| hasn't been updated since April 2020 (nearing a year now)
| though Signal has, in the meantime, come up with features
| like new groups that necessitate storing more metadata on
| its servers.
| headmelted wrote:
| Wasn't this what got people into so much bother with Snapchat
| though?
|
| There's no way to undelete sent data in practice (as you've no
| way of knowing if the counterparty backed it up / screenshotted
| it etc).
|
| Sure you can _enable_ deleting messages, but you can 't
| _guarantee_ they 've been deleted - which is what I'm assuming
| puts developers off implementing the feature.
| seandoe wrote:
| But the receiver having access to the message for eternity
| isn't the only issue to address. If a phone is subpoenaed and
| the messages of interest are no longer on the phone nor on a
| server, that's a powerful feature.
| Threeve303 wrote:
| Even with proper end to end encryption and the deleted
| messages problem solved, an app like Signal is still
| relying on the rest of the OS for its security model.
| Keyboard input comes to mind as a potential weakness.
| Things like third party keyboard apps for example.
| seandoe wrote:
| I'm not saying there aren't many more points of weakness.
| I'm just saying there is value in data being proactively
| removed from places that the company has control of.
| oarsinsync wrote:
| > Even with proper end to end encryption and the deleted
| messages problem solved, an app like Signal is still
| relying on the rest of the OS for its security model
|
| Is there a circumstance where an app isn't subject to the
| underlying OS security model?
| SamBam wrote:
| The point isn't to protect against malicious receivers -- as
| you say, there's really no way to do that -- but for cases
| where you trust the receiver but want to make it as difficult
| for a third-party to access the message as possible.
| [deleted]
| guerby wrote:
| Might be related:
|
| https://github.com/pglombardo/PasswordPusher/
|
| Password Pusher - Open source secure password transfer
|
| Review by Crosstalk Solutions here:
|
| https://www.youtube.com/watch?v=0mpBLRaHtQo
| joseluisq wrote:
| Great feature, happy Bitwarden user BTW.
|
| Off-topic: For Rocket Chat users if you want temporary-encrypted
| messages exchange you could try OTR
| https://docs.rocket.chat/guides/user-guides/messaging/off-th...
|
| We are using it in one-to-one chat context to exchange temporary
| data like passwords, keys, etc.
| kemonocode wrote:
| A very interesting addition indeed to Bitwarden. I still
| personally prefer my own setup as I'm guaranteed not to run any
| risks of being siloed but I've started pointing others towards
| Bitwarden because of this and their strong commitment so far
| towards Open Source [0]
|
| [0] https://github.com/bitwarden
| CameronNemo wrote:
| Same. I use keepassxc and just sftp the database around, but I
| have my mom using bitwarden. Hopefully I' ll convince my sister
| to start using it soon too (she is not a believer in password
| managers, yet).
| dvdkon wrote:
| It's funny to me that I basically had the same setup, family
| included. My sister finally set up Bitwarden after someone
| logged into her Facebook account and started sending her
| friends a picture of Itachi. Keep hoping, security is often
| just a disaster away :)
| bisby wrote:
| I've been using bitwarden_rs [0] because it's lighter, a bit
| faster, and a lot easier to set up (it's a single docker image
| with bitwarden in it, rather than having to reverse engineer
| their docker-compose "we choose where there data goes" forced
| deployment docker script. Being a 3rd party implementation,
| Bitwarden Send doesn't work. So there are pro's and cons, but
| you can absolutely control your own data here without needing
| to use their official services.
|
| [0] https://github.com/dani-garcia/bitwarden_rs
| infogulch wrote:
| > Being a 3rd party implementation, Bitwarden Send doesn't
| work.
|
| Seems bitwarden_rs might get it too. https://github.com/dani-
| garcia/bitwarden_rs/issues/246#issue...
| legym wrote:
| Just switched over from lastpass and very happy with it. Glad i
| made the jump
| aladine wrote:
| Anyone knows how does it different from Firefox Send. What is the
| features will restrict users from abusing it. FYI, Firefox Send
| was discontinued due to security reason.
| selykg wrote:
| It does require that you create a Bitwarden account to create a
| send.
|
| I assume if abuse starts happening they will just start
| requiring a paid plan, which would allow some amount of
| additional protection.
| linsomniac wrote:
| It's been nice to see the recent additions to Bitwarden (share my
| passwords if I die, Send, ability to copy TOTP to clipboard from
| search list).
|
| Send is nice, we had a vendor use pwpush.com recently to send us
| a password. Was skeptical because I'd never heard of them before,
| but it seemed to work fine.
|
| I've been using Bitwarden for around 18 months for my family and
| a year at work. I like it, but it does have some rough edges.
|
| Was just discussing it a few days ago and one of my coworkers
| asserted: "It has UI issues that should probably be considered
| security problems." and I can't argue with that.
|
| The primary one is that when adding a new entry via Mobile, the
| "who owns this" is down past the bottom of the screen, and the
| "save" button is at the top, so you can complete the password add
| without selecting the account/collection portion, it's just
| invisible down there. Leading to the password being in the wrong
| place. The default is a selected value, rather than "no choice",
| so it won't throw an error if you don't go down there and
| complete it.
|
| Other than that, I'm fairly happy with Bitwarden. I do wish that
| there was a key to generate values into the custom fields, which
| I use for "security question" answers, so I have to generate them
| in another app and really can't use Bitwarden in mobile with
| sites that require setting up security questions.
|
| My wife uses it, but says it's ugly. So, that might be the thing
| that causes me to change to another provider... :-) (combined
| with my coworkers not really liking BitWarden's UI)
| kayson wrote:
| > share my passwords if I die
|
| I searched around but couldn't find this feature. How do you
| turn it on?
| justusthane wrote:
| I believe this is what GP is referring to:
| https://bitwarden.com/help/article/emergency-access/
| traeregan wrote:
| The idea of the other party needing to setup an account is off-
| putting to me.
|
| The way I handle this currently is to use
| https://onetimesecret.com without any added context, just the
| password string, and then send an email / message such as:
|
| _Here are the credentials that you requested:_
|
| _Username: foobar_
|
| _Password:https://onetimesecret.com/secret/6usoxihjgv1d (this
| link only works one time within X days)_
|
| You could even setup a separate link for the username, etc.
| uhinze wrote:
| Created a similar solution a while back that also lets you
| specify max views: https://pwdrop.com
|
| Happy to hear feedback!
| grok22 wrote:
| WireDoc [1] is a service I've used a few times that has an
| interesting mechanism where a party with an account on the
| system can send or request to receive files from another party
| that doesn't have an account.
|
| [1] https://wiredoc.com
| jabroni_salad wrote:
| I'm a former wiredoc customer. Their service is otherwise
| nice, but the file size limits have not kept up with the
| times. I switched to Hightail for requests and delivery about
| a year ago and have been a pretty happy camper.
|
| https://www.hightail.com/
| justusthane wrote:
| The receiver does not need an account.
| contravariant wrote:
| Has anyone figured out how to do this from the firefox browser
| extension yet?
|
| Also does anyone know what the difference between 'deletion date'
| and 'expiration date' is?
| loginatnine wrote:
| https://github.com/bitwarden/browser/releases/tag/v1.49.0
|
| I had to update my chrome extension manually but there's now a
| new "Send" button in the extension. Should be similar with
| firefox.
| Corrado wrote:
| Yea, I wasn't seeing the "Send" feature on my Firefox
| extension either, but forcing an update did the trick. It
| looks like some of the other distribution channels are a bit
| behind still. The macOS App Store version has not updated and
| there doesn't seem to be a way to force it.
| BiteCode_dev wrote:
| I assume the sender (but not the receivers) can still access
| the file in their vault after the expiration date, but not
| after the deletion date.
| forcer wrote:
| I have the same question. I am logged in FF extension and see
| no link to use this. To open web vault is too time consuming
| and clunky
| xxkylexx wrote:
| Browser extension updates are still rolling out
| timwis wrote:
| Any advantage to using this over pwpush.com in terms of security?
| trzeci wrote:
| Two feedback points:
|
| * Password field for creating new sends should be named
| differently, as by default Firefox autocompletion puts there my
| account's password there. Potentially should be exposed from
| OPTIONS panel. Alternatively it can be generated by default, and
| then once the message is created, will be shared to the creator -
| or stored in options menu of my sends
|
| * Missing an option to expire message after first opening. It's
| like a self destroyable notification that can be read only once.
| Why? For the instance if I share some confident information with
| someone that I know is going to open very soon, then once he/she
| opens the message it will be destroyed, so that if somebody
| accesses either my or my friend's machine, it will be impossible
| to read the secret message. Another aspect is that if my friend
| will try open the secret message, and it will show that message
| doesn't exist / was destoryed - then we know that message was
| compromised.
| xxkylexx wrote:
| Re point #2 - You can set a max access count to 1.
| trzeci wrote:
| Oh! Right! I think this is a ripple effect of #1 for me, this
| is how I see the panel for creation a message:
| https://i.imgur.com/IBVinx4.png
|
| So Firefox put my account password there automatically, and
| color coded that, but also did this for Max Access Count. And
| to be frank I filtered out that field when I was looking for
| relative option to solve #2 problem.
| infogulch wrote:
| I feel like you shouldn't store your master password in another
| password manager...
| chias wrote:
| serious question: why not?
|
| If you don't trust a password manager to hold a master
| password for another password manager, can you trust it to
| hold your other passwords / whatever else you store in your
| password manager?
| upofadown wrote:
| This claims to be end to end encrypted. One hard requirement for
| effective end to end encryption is that a user has a method to
| confirm that they are actually exchanging data with who they
| think they are exchanging data with (e.g. Signal's safety
| numbers).
|
| I don't see anything like this here. So unless I have missed
| something, the E2EE claim is bogus and Bitwarden ends up being a
| trusted third party in this system. The identity management seems
| to work on the basis of an email address verification entirely
| under the control of Bitwarden.
| atleta wrote:
| While you are correct that sender authentication is an
| important requirement, I think you are mixing two things.
| Having end-to-end encryption is one thing, sender
| authentication is another.
|
| It does matter what you trust BitWarden with. If you just rely
| on them for sender authentication it doesn't mean it's not
| encrypted E2E. They won't be able to look at your data, but are
| right, they could forge messages. However, even then you can do
| the authentication yourself, inside the message. E.g. send a
| hash through an alternate channel, or if it's too complicated
| (because you may argue that you could just use PGP with people
| who know how to verify a hash) then include an agreed upon
| password in the encrypted message. It's not ideal of course and
| their app could support these (like you say) but it doesn't
| mean you have to trust them or that the message is not
| encrypted end-to-end.
| upofadown wrote:
| >They won't be able to look at your data,
|
| They totally could. All they have to do is trick you into
| sending a properly encrypted message to an endpoint under
| their control. Then they can decrypt the message, read it,
| properly reencrypt it for the entity you think you originally
| sent it to and then send it along.
|
| Because they control the entire infrastructure and user
| experience this sort of thing would be trivial for them to
| do. An unsigned, anonymous PGP message (the equivalent) would
| actually be better.
| tim333 wrote:
| Trying it, it says my email address in the message, and to get
| that I had to log into Bitwarden with my email and password so
| you know it's come from that account bar it being hacked etc.
| xerxesaa wrote:
| Bitwarden does have the concept of a fingerprint phrase [1]
| which is similar to the Signal feature you mentioned.
|
| I would be cool to see this feature incorporated into Bitwarden
| Send.
|
| [1] - https://bitwarden.com/help/article/fingerprint-phrase/
| abemassry wrote:
| I wrote this a while ago and full disclosure I am the
| maintainer of this repo and I run the service, but I wanted a
| way to do full end to end encryption that was easy for me to
| use
|
| https://github.com/abemassry/wsend-gpg
|
| The downsides are it's command line only, the upsides are you
| can audit the source and the encryption happens before it
| leaves your machine. Just wanted to share it with you in case
| you were interested. I'm a Signal user as well and I like what
| they are doing too. I have some friends who only exchange
| messages with me on Signal.
| hackeraccount wrote:
| I use a combination of wireguard and never sending anyone
| anything for this use case.
| throw14082020 wrote:
| Perfect timing. Just used this to send personal information
| across email. I still included the password in the email, but the
| expiry date means my personal data won't be collected through
| passive email logging. Also added max 2 read attempts: one for me
| test it, and another for the accountant.
|
| And of course, the accountant at my company still insists on
| passing personal information through email. Another example,
| Monese bank asking me to submit all sorts of pdf scans of
| personal documents to close an account with them.
| orev wrote:
| In the past the risk with email was mostly network sniffing
| during the transfer, which is somewhat low risk given who has
| access to backbone networks, and many systems have
| opportunistic TLS enabled, which is at least better than
| nothing.
|
| However, after the Exchange hack, now we suddenly have to worry
| about all the stuff that's stored in people's mailboxes after
| delivery, which is likely a huge amount of data. I expect we're
| going to see a huge wave of identity theft stemming from this.
| alias_neo wrote:
| It's such a battle. When my wife and I were buying our home, we
| needed to send our entire lives in paperwork form to the
| solicitors.
|
| I asked if they have a secure mechanism for file uploads and
| they responded "email is fine". No, email is not fine.
|
| They _really_ struggled to understand why I wouldn't just email
| them every document they asked for (from birth certificates,
| marriage certificates, 6 months of financial data, 12 months of
| pay slips, and a host of other things).
|
| In the end I hosted them myself and phoned them with a
| password, then deleted them once I'd seen they'd been accessed.
|
| Unfortunately, I have no confidence that they have, did nor
| will handle all of that information appropriately once they
| receive it.
|
| How is it not complete insanity to require _that much_
| information on someone and _not_ have strict training and
| liability for managing it?
|
| Between then and now, Firefox Send has come and gone, but
| fortunately it's open source, so I'll host that if I find
| myself in a similar situation in the future.
| adolfojp wrote:
| I know of a reasonably large travel agency that asks their
| customers to send a photo of their passport, driver's
| license, and credit card to a random employee's personal
| email account. I warned my brother against sending them his
| information and he saw me as the problem.
|
| I have a client that stores similar information in an
| external HDD in a shared office that a lot of people have
| access to. I convinced him to let me install BitLocker at a
| minimum and to allow me to have his computer lock
| automatically. He had another guy remove full disk encryption
| because it was a hassle when he moved the HDD around and
| remove the auto lock because he wanted his secretary to
| access the computer when he was away from keyboard.
|
| I know an accountant who calls me paranoid when I talk to him
| about securing the devices that he uses to store tax
| information about all his clients.
|
| We need regulations and fines because the only way in which
| people are going to listen about security is if it hurts
| their pockets.
| solarkraft wrote:
| Luckily there is such regulation in the EU (but it could
| arguably be better enforced). Are there no such things in
| the US?
| adolfojp wrote:
| Sort of but not quite.
|
| Sending CC info through email violates the PCI DSS. The
| PCI is a private organization so noncompliance is not a
| violation of the law.
|
| There is no unified law across the US that deals with
| data privacy. Several states are starting to address this
| problem but there's nothing like what the EU offers.
| HenryBemis wrote:
| If the solicitors were acting on behalf of the bank, then
| they are bound by the contract _with_ the bank. If the bank
| is a half-decent bank, they have a third-party security risk
| assessment & risk management team, that audits them
| regularly.
|
| You are thus covered/protected, because if they (solicitors
| get hack, leak data, etc) the bank will (most likely) spot
| this, and move to protect you.
| loloquwowndueo wrote:
| Yeah because banks are notoriously good at protecting
| consumers. "1 year of free credit monitoring" is just to
| cover their asses but won't save yours in case of a major
| leak.
| jtbayly wrote:
| This sounds like wishful thinking at every step.
| HenryBemis wrote:
| Whoah plenty downvoting.. I assume that everyone is fully
| aware of Banks' Third-Party Security protocols/procedures
| and have good/working knowledge that they don't operate?
|
| Anyway, not wishful thinking. Actual/reality. Feel free
| to ask your banks about their TPSM.
|
| Good opportunity to see some info: I use BrightTalk (not
| affiliated) to collect CPEs for my certifications. They
| have plenty of webinars on Third Party Security: https://
| www.brighttalk.com/search/?q=%2Bthird+%2Bparty+%2Bse...
| A4ET8a8uTh0 wrote:
| Eh, I am in both camps at the same time. I know what you
| are saying is true in theory, but in practice ability to
| make money efficiently trumps everything else. Even at
| bank bank you see people cutting corners for variety of
| reasons ( and when you see it you have to react ). I
| can't even imagine how bad it is in unregulated/less
| regulated industry.
| jtbayly wrote:
| Setting aside everything else, on what basis would they
| moved to protect you as opposed to protecting themselves?
| And even even if they are forced to by bad publicity or
| something, what can they possibly do for you anyway if
| there's a leak, other than offer you a useless year of
| identity theft "protection"?
|
| In other words, I still maintain this is wishful
| thinking.
| cube00 wrote:
| The real estate agent we had replied with "but I don't
| understand why you won't email your documents, we've never
| had a problem using email to send sensitive documents before
| and we've done it hundreds of times"
|
| We hear about leaks of user databases all the time now so I'm
| surprised we don't hear more about mail boxes leaking out.
| All these small business mail boxes must be an identity
| thief's dream.
| girvo wrote:
| Access to small business mailboxes is used for a "neat"
| form of fraud; they intercept invoices and change the
| account details to theirs. It's a bit of a long-ish
| targeted attack, but it makes the news now and then.
| kevincox wrote:
| Assuming that you have your email configured to require TLS
| on the receiver than I don't see what is wrong with email.
| Even if they downloaded the files from your server they
| probably just stuck them on some file share which at best is
| just as secure as their email inbox was. Many organizations
| have policies for email retention and similar that is less
| likely to be enabled for file storage.
|
| I would love to see more places just use email. Instead I get
| these messages with links to proprietary services to get the
| file. Now I need to download and store it out-of-line with my
| conversation.
|
| I think the major issue with email is that encryption is
| optional with transparent downgrading. You can imagine that
| if it supported something like mailtos:me@example then it
| could be used as a secure medium, much like https can be
| trusted today.
| monkeydust wrote:
| You have to assume anything you send can become compromised
| and then game out what would be the ramifications of that.
|
| Its good you de-risked this somewhat by avoiding email
| thought, that's a good first step and I wish there was a
| standard for this.
| blub wrote:
| And after they downloaded your secured file, they probably
| sent them between themselves over e-mail.
|
| This is why laws like the GDPR are needed.
| VMG wrote:
| The GDPR does not fix this at all.
| coddle-hark wrote:
| Yes it does. For instance, most places don't send
| payslips over email for GDPR compliance reasons.
| rlpb wrote:
| It does. See for example the Ticketmaster case. They were
| fined PS1.25 million under the GDPR:
| https://ico.org.uk/action-weve-
| taken/enforcement/ticketmaste...
|
| A key justification for the fine (see the report eg.
| sections 6.3 through 6.7) is that "there were multiple
| failures by Ticketmaster to put in place appropriate
| technical or organisational measures to protect the
| personal data being processed on Ticketmaster's systems,
| as required by the GDPR."
|
| Process data without taking appropriate steps to protect
| that data and you face being fined under the GDPR.
| bitexploder wrote:
| I work in infosec consulting and reversing for 15 years. My
| identity has been compromised numerous times via OPM,
| Equifax, and Home Depot, just to name a few. I just don't
| care about emailing sensitive docs anymore. I find an
| alternative if possible, which usually it works. I put in
| some effort. But realize emailed financial docs aren't likely
| how you get owned. It doesn't feel great, but it is what it
| is.
|
| E: also, almost everyone I've asked will delete the documents
| after you try and fail to set up an expedient file share.
| Also, password protected zip files in Dropbox are usually
| good enough for most everyone and are a very simple system.
| Just make sure you use modern zip protection and not old
| crappy Zip crypto :)
| waheoo wrote:
| Compromised or stolen?
|
| Identity theft can fuck you indefinitely.
| weird-eye-issue wrote:
| Maybe if it goes unnoticed for several years... But even
| then indefinitely sounds like a stretch.
|
| I've personally had my identity stolen last year and they
| got a car loan, insurance, and bought a couple iPhones
| and lines with two different providers. It happened in
| the month I was closing on my house and getting a
| mortgage. Yeah it was a bit of a pain but some phone
| calls, a police report, notarization, and snail mail
| later and it is off my record and my credit score went
| right back over 800. Also I was still able to get the
| mortgage even with it going on.
| bitexploder wrote:
| Identity theft happened to me once from another person
| with my same name using my identity to run up credit.
| It's not that hard to fix, it just takes fighting
| bureaucracy. They got my info from some lender somehow
| getting my data and giving it to them. Someone's email
| spool getting compromised and that leading to identity
| theft is such a smaller concern compared to all these
| data warehouses just leaking your data.
| Legogris wrote:
| Double-comment but check out
| https://github.com/algolia/sup3rS3cretMes5age
|
| I live in a country where sharing my entire life in paperwork
| is sadly normalized. Having a self-hosted one-time-secret
| service for file uploads is so nice.
| icecap12 wrote:
| Agreed - there are entire industries that simply have not
| caught up with secure management of paperwork, PII and
| financial information. To be frank, I'm not sure how that's
| possible with all the regulation.
|
| The mortgage industry is shockingly one of these. I just
| refinanced again after doing it 5 years ago. I was really
| curious to see if anything had changed in the 5 years. Any
| advances in basic tech? Was my experience going to be more
| secure?
|
| Answer: Nope. Still the same old stuff, hard copies of
| everything, people asking me for stuff via email. Blatant
| disregard for privacy. Just absolutely terrible.
|
| Multiple times the guy at the bank asked for my banking
| statements (which include full account number, balances, PII,
| etc.) and EVERY TIME I had to ask him to resend the link to
| their secure email portal. Worse - they never even offered
| secure transmission as an option... _I_ had to ask about that
| option. It 's clearly not the default behavior.
|
| Interestingly, the closing company was lightyears ahead of
| the bank. They had contracted a SaaS vendor that provided a
| secure digital document management product focused on
| mortgage closing, and I was able to e-sign everything (even
| able to scan in my signature and apply to documents). I mean,
| this isn't earth-shattering tech, but it sure was one hell of
| an upgrade compared to the bank. That's what all banks should
| be providing today; overall it was a far better experience
| than the bank.
| pentae wrote:
| This is the only thing I still use Dropbox for after moving
| my files away a long time ago. Set up a password protected
| folder, send the link over email and SMS them the password or
| tell them over the phone. Easy peasy.
| JshWright wrote:
| Yeah, they definitely just attached them to an email they
| sent to whoever they would have forwarded your email to if
| you had sent it that way.
| USNetizen wrote:
| I don't know about anyone else, but I'm leery of apps that say
| "proven security and compliance" and then don't offer any obvious
| details, or proof, about what that "compliance" is. ISO 27001,
| SOC2, what?
| whoisburbansky wrote:
| Clicking through on the link under that section explains that
| they're compliant with GDPR, Privacy Shield, CCPA, and HIPAA on
| the privacy side. In addition, they've completed SOC 2 Type 2
| and SOC 3 compliance, have a link to security
| assessments/penetration tests/cryptographic analysis done in
| 2020 and 2018 by third party pentesting firms. For each of
| their claims, they've got links explaining details, and if none
| of that is enough, it's completely open source, so you can go
| code spelunking yourself to verify their claims.
| BiteCode_dev wrote:
| I like the feature, but if it requires somebody to creates an
| account, it's a hard sell.
|
| If they got a signal account, which is more likely than a
| bitwarden account, I'll ask them to use that. If they don't, then
| something like 0bin.net will likely be easier to use (no account
| necessary, just copy/paste).
|
| Now, bitwarden allows you to send any type of file, which is
| better than 0bin, being very limited in size, and to text and
| pictures. But you need a pro account for this.
|
| So I'm not sure how it's better than the competition. Although
| I'm posting this comment so that someone on HN can show be I'm
| missing something.
| contravariant wrote:
| I just checked, you don't need an account to open the generated
| link.
|
| Though the documentation could use some work.
| nelsonenzo wrote:
| Oh, so if someone uses this wrong (no exp, no password), than
| these vault links are open to the public?
| contravariant wrote:
| Well yeah, but you already had the possibility to share
| passwords with groups of other Bitwarden users so that's
| kind of the point.
| BiteCode_dev wrote:
| Ah, that's good, I missed that, thx.
|
| And the bitwarden trademark is also a selling point.
|
| Although it still requires the other party to create an
| account if they want to send me something.
|
| Maybe I should make a PR to add passwords to 0bin though.
| killingtime74 wrote:
| Bitwarden can be self hosted as well
| syshum wrote:
| While that is true, it is unclear is the Send feature is
| available on the self hosted,
|
| Further most of the time people are using the opensource fork
| / rust rewrite of BitWarden (bitwarden-rs)which may not have
| all the features of the official bit warden
| hda111 wrote:
| I don't get why most people trust this unofficial clone.
| It's neither audited for security issues (unlike official
| bitwarden) nor is it developed by bitwarden.
| novium wrote:
| Just checked, should be available on the self-hosted
| version as well. [0] And the author of bitwarden_rs seems
| to be planning to tackle it over the weekend!
|
| [0] https://bitwarden.com/help/article/send-hosting/
| BiteCode_dev wrote:
| 0bin is a very simple python script and can be hosted as
| well.
| kitkat_new wrote:
| Messengers are not per se insecure. Sending via Matrix should be
| fine as well - why use another tool?
| cooperadymas wrote:
| Because you don't use Matrix?
|
| Because the person you're sharing with doesn't use Matrix?
| cpach wrote:
| I know lots of people who use Whatsapp, Signal and iMessage.
| I'm not aware of anyone in my friend circle who use Matrix.
| julianlam wrote:
| This is very exciting news for the Bitwarden team, if only
| beacuse Firefox Send went away and there's not really been a
| suitable replacement since. There was onetimesecret, but I never
| really trusted it...
|
| However, FF Send was shut down because keeping up with nefarious
| users uploading illegal content was a full-time job in and of
| itself... I wonder what Bitwarden will be doing to solve the
| problem.
| timvisee wrote:
| https://send.vis.ee/
|
| https://github.com/timvisee/send
|
| :)
| wtmt wrote:
| I've seen your site's link in this conversation at least a
| couple of times, and am curious as to how you manage the
| costs of running the service. Is it not as well known that
| the costs are quite low or the cost doesn't matter to you
| because of your chosen provider? Since Firefox Send was
| shutdown due to abuse related issues, what are your thoughts
| on offering this alternative for free (more so with a 10GB
| limit, which is much higher than what the Firefox Send limit
| was)?
| timvisee wrote:
| Cool, yeah maybe you've seen me linking it before as well.
|
| I pay for it myself, with the help of some awesome
| donators. It isn't too expensive to run, mostly because
| files have a maximum life time of a week. You might wonder,
| what is the catch? If it ever becomes to expensive for me
| personally, I'll take it down (disabling uploads, and
| taking the whole instance down a week later). But it should
| be fine for a while!
|
| You're right. Mozilla's Send instance was abused. My
| instance doesn't have a big name such as 'Mozilla' or
| 'Firefox' attached, which probably makes it a lot harder to
| convince unknowing people to download random files uploaded
| on it. I haven't seen any real abuse yet.
|
| About the 10GB upload limit. I try to balance it with usage
| and cost. I've set it to 1GB, 2GB and 5GB before. I'll keep
| it at 10GB now, but might change it if storage becomes an
| issue.
| matheusmoreira wrote:
| Why would these services have to care about illegal data? The
| data is end-to-end encrypted, they don't know what is being
| sent. There is no reason to even store it on their servers.
| orev wrote:
| If the service is being used to distribute malware, then they
| do need to care. It causes reputation issues, could get the
| site added to block lists, and may carry legal liability.
| This is why Firefox Send was shut down.
| rndgermandude wrote:
| It gave you a link to be shared, that essentially embedded
| the cryptographic key to decrypt. It's basically the same
| scheme that e.g. mega.nz uses too (their "share link"
| feature), and similar encrypted services.
|
| These links weren't just shared one-on-one in some private
| channels, but people posted the links in (semi-)public places
| as well. If it was something actually bad or at least "bad",
| a lot of times other users, law enforcement, or copyright
| owners would report these links back to mozilla, requesting
| the link be disabled and the content taken down.
| trinovantes wrote:
| What are some other secure ways to send varying file sizes from
| my computer to one/many others e.g. how would you securely send
| 1MB, 1GB, 1TB?
|
| I'm thinking once you're past 1TB, you're better off mailing an
| (encrypted) physical drive but I'm curious about other solutions
| especially if you have gigabit internet at home
| rakoo wrote:
| For now the best way I have found is to put the content on my
| website, in a folder protected by a password and served by TLS
| only. Anyone can receive it, I control expiration and access,
| even as a sender I'm using extremely simple, reliable software.
| It's not like I need to send a lot, it just works.
|
| The hardest part is being able to have a domain name that links
| to my machine. After that Caddy makes everything extremely
| simple.
| tyingq wrote:
| 1TB at 100Mbps is about a full day of transfer.
| miki123211 wrote:
| Resilio Sync. It's like a cloud but over p2p, so there are no
| size limits. You need both devices to be online at the same
| time (not necessarily connectable, their servers can handle
| that). It's free, pretty easy to set up and just works. It does
| encryption by default, but if you want a layer of extra
| security on top, just put your data in a Veracrypt container
| and send that instead.
| sidpatil wrote:
| Syncthing is a FOSS alternative: https://syncthing.net/
| I_Byte wrote:
| I have been using Syncthing for a few months now and I love
| it!
| juskrey wrote:
| Resilio is quite the head or two above - very polished
| commercial product, actually, with basic free license. From
| the authors of original bittorent protocol and client.
| ErikBjare wrote:
| I can't imagine it being "a head or two above". Syncthing
| has worked flawlessly for me for almost 5 years now.
| [deleted]
| o_m wrote:
| I recently moved about 1TB of video files to S3, before moving
| it to another service that supported importing via HTTP. Not
| sure if there are any better alternatives for this, I would
| love to hear about an alternative.
| rgacote wrote:
| I've been using Scribo (scriboco.com).
|
| In addition to sending files, I can request files from a third
| party. Includes document signing and payments (which I've not
| used).
| Taek wrote:
| https://skysend.hns.siasky.net/ is a neat way to send up to 8
| GB. Handles smaller files just fine as well.
|
| We've transferred as much as 250 GB I believe using scp over
| the local network. But that was obviously between roommates.
|
| You're probably right that once you're in the TB range,
| actually sending a drive is the way to go. Egress on Amazon is
| more expensive than buying and then shipping physical disks.
| mcny wrote:
| What is sia sky doing differently from Mozilla send? My
| understanding is that Mozilla send got overwhelmed by
| malware?
| Taek wrote:
| It's decentralized. For example, the exact same service
| exists at https://skysend.hns.skyportal.xyz, which is
| operated by a completely unrelated party. Links created on
| one will work on the other.
|
| And you can run your own portal, code and instructions
| here: https://github.com/NebulousLabs/skynet-webportal
| (roughly a weekend of work to set one up at this point)
| rozab wrote:
| croc is my favourite way of transferring files between
| computers I control.
|
| https://github.com/schollz/croc
|
| It's similar to magic wormhole if you've heard of that, but a
| bit more polished. I think for me it offers the best possible
| UX.
|
| transfer.sh is also good if you can't install these for
| whatever reason.
| deepstack wrote:
| wormhole, onionshare, syncthing
|
| Depends on if people you are send are online at the same time.
| If they are not online at the same time, you would need some
| in-between services. Or else you can just rsync the files
| between you guys.
| Dragging-Syrup wrote:
| Nextcloud--if you're already using--it is awesome.
| sir_eliah wrote:
| I've just got approval to publish the app to the Flathub, so
| you might consider Dragit:
|
| https://flathub.org/apps/details/com.sireliah.Dragit
|
| It's relatively simple p2p app with host auto-discovery.
| Payload is encrypted and performance is pretty decent. Built
| using rust, libp2p and gtk.
|
| Edit: works on Linux and Windows; repo is here:
| https://github.com/sireliah/dragit
| ntoshev wrote:
| https://magic-wormhole.readthedocs.io/en/latest/welcome.html...
| syoc wrote:
| This is a holy grail I've been looking for. The use case is
| receiving MB to TB size files. Requirements are a web
| interface, resuming transmissions, self hosting, open source,
| encryption and AD integration for users.
|
| https://filesender.org/ looks promising but I have not had the
| time to look into it yet.
| cryo wrote:
| cryo, a native Qt5 application provides end-to-end encrypted
| arbitrary large p2p file transfers.
|
| https://cryonet.io
|
| Shameless plug I'm the dev and using it daily :)
| dastx wrote:
| Looks really good, but if it's p2p having a speed limit seems
| silly.
|
| Note: I'm obviously thinking from a user perspective, I'm
| sure others, especially non-technical people might find this
| reasonable. From a business perspective I suppose it does
| make sense.
| shrew wrote:
| The promise of this is great and being a feature of Bitwarden,
| which is already fairly well trusted, is a plus in terms of peace
| of mind. But did anyone else find the demonstration a bit
| underwhelming?
|
| I've used sites like One Time Secret[0] before and one of the big
| benefits is that it's pretty fast to store the sensitive data,
| grab the link and send back to the colleague. Bitwarden Send
| looks as though you need to be logged in to the Bitwarden site,
| dig out the feature page among the rest of your password manager
| and fill out a whole form in order to get a link to send, which
| would add a barrier to entry for the whole process that wouldn't
| encourage its use.
|
| Maybe it's just me. It certainly looks like a good feature either
| way.
|
| [0] https://onetimesecret.com/
| addicted wrote:
| Well, most people use Bitwarden through apps, and this is
| present in their apps.
|
| I think it's a mistake to think of Bitwarden send as a stand-
| alone product, but rather as a convenient feature add to their
| existing (free and open source) password manager.
| windthrown wrote:
| That barrier to entry may reduce the amount of nafarious users
| uploading files, which is what led to Firefox Send's demise.
| Legogris wrote:
| As a self-hosted alternative if one already has Vault (or is OK
| with a provided single-node installation), this[0] is great. I
| use it when sharing private stuff over unsecured channels
| regularly.
|
| [0] https://github.com/algolia/sup3rS3cretMes5age
| waheoo wrote:
| Does bitwarden self hosting not include this feature yet?
|
| https://bitwarden.com/help/hosting/
| GordonS wrote:
| I use http://transfer.sh for sending large files between machines
| on different networks - you don't even need an account to use it.
| I presume there must be a maximum file size, but I haven't hit it
| (yet).
|
| Still, nice to have another option incase transfer.sh goes away!
| pbronez wrote:
| What's the business model for transfer.sh? It looks like a free
| service that hosts your files on their servers temporarily.
| That sounds like a variant on the image hosting problem, where
| it's unsustainable if it gets popular. You also have to trust
| them with your encrypted data.
|
| The nice thing about magic wormhole is that the hosted service
| only provides NAT busting / initial connection set up. Yes,
| this means you have to do direct, real time transfers, but it's
| also much more secure and cheaper for the bridge host.
| GordonS wrote:
| There used to be a notice on the site explaining that it was
| hosted by Storj.io, but it appears to be gone now.
|
| I should have also mentioned that it's an OSS project, so you
| can self-host if you want:
| https://github.com/dutchcoders/transfer.sh/
|
| Oh, and there is also https://keep.sh, which is free for
| files less than 500MB - they have a commercial offering too.
| sodality2 wrote:
| Seems like 10GB according to their site.
| hedora wrote:
| Regarding the self-hosted version: ARM support would be nice. I
| dug in a bit more, and bitwarden is written in .NET core and SQL
| Server T-SQL.
|
| .NET core is open source these days, but not SQL Server from what
| I can tell. I wonder if making it portable (to other
| architectures/BSD) would be a complete rewrite, or if there's
| some easy path forward.
| wtmt wrote:
| You could also consider bitwarden_rs, an open source Rust based
| implementation of the BitWarden server that supports SQLite and
| MySQL (Postgres support is also coming). [1]
|
| [1]: https://github.com/dani-garcia/bitwarden_rs
| nwah1 wrote:
| This issue claims they are starting work on PostgreSQL support
| this week.
|
| https://github.com/bitwarden/server/issues/453
| hedora wrote:
| Thanks. It looks like .NET core works (but is unsupported) on
| FreeBSD. That's future proof enough. I have a gripping day of
| LastPass migrations ahead of me. :-)
| swiley wrote:
| Is it really more trusted and secure than onionshare?
| xerxesaa wrote:
| Onionshare, to the best of my knowledge, requires you to have
| your computer running while the recipient downloads the file.
| It's a web server. It also requires you to download software.
|
| In this way, it's less convenient than a hosted service which
| can run in any browser. But yeah, the security of onionshare is
| good and the fact that you don't need to create an account
| makes it even better.
| nelsonenzo wrote:
| Keybase alternative. Nice!
| FourthProtocol wrote:
| So the basic package says you can share passwords with one other.
| But it also says core features and sharing are 100% free. But
| when you click on that box that mentions core features you (I
| mean me) expect to see what core features are. Instead I'm asked
| to create an account. For a thing that's supposedly free. So no
| sell. I'm really sorry because I want to like software like this,
| but not like this.
| sofixa wrote:
| How do you expect a password manager, which is what Bitwarden
| is at its base, to work without an account?
| yepguy wrote:
| Bitwarden Send, the feature under discussion, could certainly
| work without an account. (It's nearly the same thing as
| Firefox Send, which didn't require one. Although using
| accounts probably helps prevent abuse, which I think is what
| forced Firefox Send to shut down.)
| JustSomeNobody wrote:
| It _could_, but the entire point is that it is an _added
| feature_ for those _with_ an account.
| waheoo wrote:
| The links it generates does.
| neogodless wrote:
| https://bitwarden.com/pricing/
|
| You don't click "Create Free Account" to see the list of
| features. Just scroll down.
|
| (on mobile)
| GordonS wrote:
| IIRC, Firefox Send shutdown because it was getting abused - I see
| you need an account to use Bitwarden Send, which I imagine helps
| mitigate against that, but it's also a barrier to use. Would be
| interesting to know what other anti-abuse mechanisms are in
| place.
| addicted wrote:
| Bitwarden Send is a feature add for existing users. It solves a
| very real problem of sharing passwords (and other sensitive
| information) with others.
|
| Before Send, the way Bitwarden recommended sharing data was by
| creating a group account of some sort (family, business), and
| using a shared collection.
| GordonS wrote:
| Ah, for some reason I assumed it was a separate product, but
| that makes much more sense.
|
| I've never been keen on cloud-hosted password safes, but this
| is a pretty nice addition for Bitwarden users.
| selykg wrote:
| Bitwarden does have a 100mb limit. Which I think will prevent a
| good chunk of abuse.
|
| I would love to see them increase the limit for paid accounts,
| though.
| okamiueru wrote:
| I find it interesting how many business models and ideas are
| obsolete if there was a wider and easier adoption of gpg. It's
| over two decades old, but not aged in a bad way. I wonder why it
| isn't integrated better in OS-es, or part of education, as it's
| such a useful tool. I get why these products pop up, because they
| solve the initial inertia and make it accessible. Maybe it's OSS
| licensing, maybe US laws regarding crypto, hm. Does anyone have
| thoughts on this?
|
| Edit: my ability to communicate seems to be pretty bad today, so
| let me clarify. The question is about enhancement/integration in
| terms of usability, and not lack of adoption "as is". I'm well
| aware that the reason why it's not more adopted is because it
| isn't easy to use, otherwise these services wouldn't be popping
| up that makes it more user friendly. Hence the "... obsolete if
| there was a wider and easier adoption of gpg"
| nonameiguess wrote:
| ProtonMail seems to have become reasonably popular and uses
| pgp, though it doesn't require users to be aware of this.
| atleta wrote:
| For this to work it would have to be included in all major OSs
| and/or browsers. People just use what they know and what they
| can use, even if it sounds tautological.
|
| E.g. it's pretty hard to convince even small groups to use a
| mailing list, to upload e.g. photos of shared interest to e.g.
| a google drive (instead of mailing them around or just sticking
| them into a FB group). It's doable but it's not the norm.
| okamiueru wrote:
| I'll mention this article I was directed to by jsmeaton that
| really highlighted a lot of the reason why there is inertia
| behind such UX friendly integrations of PGP backed solutions:
|
| https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
|
| It's the best break down I've seen of PGP and it really took
| me out of my flawed notion of PGP, and that it is maybe not
| so 'pretty good' as I had thought.
| zokier wrote:
| As I understand that was sort of the thinking behind Keybase
| before they pivoted more into groupware and more proprietaryish
| stuff (and eventually got bought out)
| toyg wrote:
| Apart from the obvious usability thing, I think key management
| is the main problem. With a solution like this, the user does
| not even know keys or certificates _exist_. Anything involving
| GPG, no matter how easy you make it, will require some
| knowledge of those concepts.
|
| .. And if you say "but what if the app did it all for you
| behind the scenes" - at that point, it would look exactly like
| this and the fact it's gpg based or not would not matter to
| anyone, not even to you.
| kitkat_new wrote:
| or if email got replaced with Matrix: https://matrix.org/
| lxgr wrote:
| > Does anyone have thoughts on this?
|
| Many people do, and it usually boils down to usability (or more
| precisely, the lack thereof).
| nindalf wrote:
| I have thoughts. It's very similar to why dropbox is a thing.
| In the original Show HN for Dropbox, the top comment assured
| the founder that it could easily be replaced with sshfs and a
| version control system. For some reason, the average consumer
| found Dropbox easier to use.
| okamiueru wrote:
| I mean, I'm not asking why something easy to use is used more
| than something not easy to use. That would be silly. Maybe
| someone thought that, and that's why I got downvoted? What
| you've replied can be reduced to "because it's easier to
| use". These are not the thoughts I'm after, so let me clarify
| / reiterate.
|
| I'm asking why a highly usable technology that has been in
| existence for two decades has not found its way into a
| accessible easy to use implementation. Seemed like an
| interesting thing to get an opinion on, but I also don't care
| enough to offend anyone.
| nindalf wrote:
| > a highly usable technology
|
| I think the consensus is that GPG isn't easy to use.
| Perhaps it only seems easy to use for you because you're
| used to it? Kinda like git. Git's UX is objectively bad but
| it doesn't bother me because using it is second nature now.
| I don't think it would be easy for a non-programmer to pick
| up.
|
| That's why people use document versioning provided by
| Google/Microsoft/Apple/Dropbox/Adobe rather than using git
| from the command line. It's the same with GPG.
| okamiueru wrote:
| I think you're being obtuse, either intentional or not.
| The technology is useful because of what it does, and my
| ability to use it is irrelevant. In a "nuclear fusion is
| a useful technology" sense. Everything else I've
| explained twice now should have made that explicit and
| abundantly clear, so, I think I'm done here. Feel free to
| not continue this conversation.
| jmercouris wrote:
| I think many open source technologies drop the ball when
| it comes to integrating a nice application. Seems that
| the protocol and implementation is nice, but the user
| interface is lacking. Perhaps that is not an interesting
| part of development for the GPG team.
| megous wrote:
| There are many GUI frontends for GnuPG, if that's useful
| to someone:
|
| https://www.gnupg.org/software/frontends.html
| nindalf wrote:
| You said "usable" when you meant "useful". And then you
| got upset when I took your comment at face value. Talk
| about childish.
| okamiueru wrote:
| That was indeed a autocorrect issue, and if that was what
| caused the confusion, I apologize. I've also done nothing
| but reiterate the same point from the start, which you
| seemed quite opposed to consider. This has also devolved
| into name-calling, so, not sure why you bothered at all.
|
| Even if admittedly, the word "usable" (hard to
| misunderstand in the context, IMO) should have been
| "useful", the usable part of this could very much have
| been for other knowledgeable software
| developers/designers for it to be the backend of
| something user-friendly. As such, not even "usable" in
| that context would have been wrong. Regardless, this
| would require some modicum willingness for benefit of
| doubt, which, I do not expect at this point. My only
| advice to you, is that perhaps don't assume people are
| children, and perhaps you'll find it easier to see
| meaning in their arguments.
| waheoo wrote:
| What's wrong with gits usability?
| jsmeaton wrote:
| https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
| Is a pretty good tear down of pgp. It doesn't sound like
| pgp can be made more usable.
| okamiueru wrote:
| That was a very interesting read, and covers all the
| issues I had with GPG/PGP broken down on a per-use-case
| basis, which is really neat. Fairly up-to-date too (aside
| from maybe WhatsApp mentioned alongside Signal). In any
| case, thanks for sharing! Nice to see simplified and
| somewhat modernized tools like
| (https://github.com/str4d/rage) and
| (https://github.com/FiloSottile/age)
|
| The article that post mentions in the beginning also had
| some interesting perspectives, though a bit older.
|
| https://blog.cryptographyengineering.com/2014/08/13/whats
| -ma...
| megous wrote:
| Dropbox also has CLI. If that was the only way to access
| dropbox, average consumer would be out of luck too.
|
| GnuPG has a ton of frontends. I can do three clicks in gajim
| and have chat secured by GnuPG. Or manage keys with some
| system keyring app like seahorse
| (https://wiki.debian.org/Seahorse), or whatever.
|
| The problem is only education. Dropbox just pays a ton of
| money to put their solution in front of people's eyes via
| ads, and whatever.
|
| GnuPG obviously does not do that on the same level.
|
| Also securing your communication via asymmetric cryptography
| requires a bit more understanding and data hygiene than
| uploading a file somewhere. So it will be an uphill battle
| regardless of the UI.
| mekster wrote:
| > The problem is only education.
|
| I don't want to be educated to use something and I'm a
| developer for 20+ years.
|
| I wouldn't consider to use any services unless anyone (as
| in company staff) wouldn't be bothered to use it.
|
| I can't really recommend Bitwarden Send when pasting files
| in a self hosted Mattermost chat room would suffice for
| internal use.
| megous wrote:
| I was writing about GnuPG.
| pydry wrote:
| Seeing how many people lose their bitcoins or prefer to host
| them illustrated to me what the natural inhibitions to GPG
| were.
|
| I think the assumption it builds in that users fully own and
| have full control over their device never fully held and will
| become less and less valid over time also. With the "thin
| client" model and careless users, GPG breaks.
|
| Also, the NSA clearly wanted to kill the project. I'm pretty
| sure they engaged in some smarter and more underhanded sabotage
| after the obvious failure of classifying math as munitions
| export.
| lxgr wrote:
| Maybe I'm missing something, but how can this be end-to-end
| encrypted when the password is optional, and there is no fragment
| in the shared URL?
|
| Update: Turns out fragments are used for key sharing after all.
| This (in my opinion crucial to anyone aware about the difference
| between query parameters and fragments) bit is left out from the
| promotional video.
| nelsonenzo wrote:
| What's a url fragment? How is it more secure?
| pnt12 wrote:
| As I understand it, a fragment is just read by the browser, a
| parameter is sent to the server.
|
| A common fragment is when you click some section of a website
| oagr and it changes the link to include #section-x, and if
| you bookmark it you browser will scroll to the right place
| automatically.
| rakoo wrote:
| URL fragments are the part after the hash symbol (#) like
| this:
|
| https://en.wikipedia.org/wiki/Donald_Trump#Books
|
| the original use case (still used today) is to be able to
| jump to the first DOM element with such an ID; typically
| title elements, such as the "Books" above. It is only used by
| the client, so is never sent to the server.
|
| Now with web applications, thanks to javascript, you can
| retrieve and use it. So now instead of using it as a locator
| inside of a page filled with content, you can use it as a
| string that you know isn't shared with the server: it's
| perfect for a secret key. You can send the receiver a link
| with that key, they will put it in their browser, receive the
| javascript from the server and use that javascript to decode
| content thanks to the key.
| MrGilbert wrote:
| I love the fact that it's not just a seperate product, but it's
| also included in the existing bitwarden password safe. That's
| just awesome. I can't wait for v1.40 to be released on monday for
| self-hosted instances.
|
| Best 10 bucks I spend annually, tbh...
| ollybee wrote:
| There are number of open source projects that do the same thing
| such as https://privatebin.info Adding some marketing on top
| seems like a good thing as pasting passwords in chat happens too
| often in many organisations.
| nindalf wrote:
| I'm probably going to have to leave LastPass later this month.
| Bitwarden seems like it ticks all my boxes, especially around
| self hosting. There's a Rust server implementation made by the
| community that doesn't require much resources so I could stuff it
| on an existing crowded server I rent.
| nxc18 wrote:
| I just switched last week, so can confirm that as of very
| recently, it is still far superior to lastpass.
|
| Two notes worth highlighting
|
| - UX is much lighter and more reliable for Bitwarden on web
|
| - iOS implementation of Bitwarden is faster, more reliable, and
| has better interaction with the keyboard than last pass. I find
| the Bitwarden experience on iOS a considerable upgrade.
| shafyy wrote:
| I've tried LastPass and 1Pass before, and switched to Bitwarden
| 2 years ago. It's the best!
| tuxone wrote:
| Too bad Bitwarden does not support sync to
| folder/iCloud/Dropbox/whatever. I prefer not to deal with
| self hosted environment but I also am worried about depending
| on someone else hosting for accessing my passwords.
| [deleted]
| thedanbob wrote:
| I currently use Enpass which supports syncing via many
| services including those. I'll probably switch to Bitwarden
| eventually because I'm a magpie but I haven't so far
| because Enpass does everything I need.
| tryptophan wrote:
| AFAIK the bitwarden apps hold a local copy of your
| database. So if the servers go down you just use the local
| database, from which you can also export from to csv as
| well.
| faitswulff wrote:
| It does. Here's the support document showing where the
| vault data is stored:
| https://bitwarden.com/help/article/data-storage/
| nelsonenzo wrote:
| Not on mobile
| TumorousJoker wrote:
| Then you're better off using KeyPass or one of its
| derivatives.
| juriansluiman wrote:
| I have done exactly the same more than a year ago. Couldn't be
| happier. The bitwardenrs server is extremely lightweight so it
| runs with almost no resources.
|
| Please consider bitwardenrs is a 3rd party implementation,
| indeed community led, so it lags several features which have
| been introduced by Bitwarden itself.
|
| See the full list of feature requests in the Rust
| implementation here [1], but the two things I'll miss most are
| Emergency Access and now this feature called Bitwarden Send.
|
| [1]: https://github.com/dani-garcia/bitwarden_rs/issues/246
| Cu3PO42 wrote:
| bitwarden_rs works great for me and was easy to deploy.
| However, it doesn't support Bitwarden Send. Not a deal breaker
| for me, but worth pointing out in the context of this thread.
| piaste wrote:
| The author intends to start working on it right now :)
|
| https://github.com/dani-
| garcia/bitwarden_rs/issues/246#issue...
|
| > Are there any plans to implement the new Bitwarden Send
| functionality?
|
| > Yeah, this one's of personal interest to me, so I'll take a
| stab at implementing it over the weekend.
| _nhh wrote:
| Nice way for browser plugins and script to access sensible
| information via dom! Even with a title suggestion the
| applications it is for! No more context sensitive chats i have to
| spy on
| huhtenberg wrote:
| Using "trusted" in a description of their own product doesn't
| look right, especially when it's the only occurrence of "trust"
| on the whole page.
|
| It's just a marketing spin, rather than a meaningful technical
| description.
| dastx wrote:
| I understand what you mean, though, to me, it read more along
| the lines of "you already trust Bitwarden, now you can use it
| to also send stuff" or something like that. Could be just be.
| Osiris wrote:
| For just sending plain text that gets destroyed after it's seen,
| like sending passwords, etc., I've used https://foxcry.pt
| FirstLvR wrote:
| i like the "Emergency access" that Roboform has, it can handle
| this sharing very well
|
| https://help.roboform.com/hc/en-us/articles/115005664827-Wha...
|
| Roboform is not recognized in the industry, but gets the job
| done, plus, it has secure notes, identities, markers, etc... all
| encrypted, and hasnt fail to me for over 4 years
| xerxesaa wrote:
| Bitwarden has this too
| https://bitwarden.com/help/article/emergency-access/
| alistaira wrote:
| Interesting project! Great to see new features coming out of
| BitWarden.
|
| One concern that is going to put me off using the feature though
| is that sharing my password manager account email with the person
| I've sent the file/text to seems unnecessary.
|
| Not everyone we share data with (particularly in the world of
| messaging) should be privy to the sender's email address.
| tweetle_beetle wrote:
| I appreciate that it's always good to question how much data,
| of any kind, is exposed, but what's the scenario where you want
| to share a secret with a specific person, but it's really
| important that they don't have the email address you use for
| Bitwarden?
|
| There are alternatives like https://onetimesecret.com which
| don't, but I can see the value in making it clear that this is
| a legitimate user to avoid phishing type scenarios.
| denysvitali wrote:
| I love Bitwarden, but this move is something that I don't like
| that much because it fragments more the way we have to share
| passwords between people / companies.
|
| For some reason GPG frontends (such as Keybase) aren't a trending
| thing, and therefore the average guy in IT doesn't even know how
| to deal with an encrypted gpg file - let alone creating one given
| my public key. Unfortunately it seems like emails are more
| straight forward, or encrypted e2e messages via Signal / Telegram
| / you name it.
|
| I would very much appreciate if somebody created something like
| Keybase and made it popular - this is a security improvement I
| would love to see in everyone's life. Things like Bitwarden Send,
| unfortunately, are probably not going to be the best solution to
| this problen and not even strong enough (e.g: not E2E encrypted).
| I wouldn't feel safe in using it to be honest.
|
| In any case, everything is definitely better than sharing
| credentials in plain text, so there is that :-)
| ImaCake wrote:
| The only time I, and probably many others, have used GPG is to
| install R on linux. So I guess you can thank the problematic
| installation procedure for R on linux for some exposure to GPG.
___________________________________________________________________
(page generated 2021-03-12 23:00 UTC)