6 ms·
I've threat modeled this myself, and as I understand it the Bitwarden client side decrypts/encrypts everything locally. So even if backend was entirely compromi
by surge 1y ago
I've threat modeled this myself, and as I understand it the Bitwarden client side decrypts/encrypts everything locally. So even if backend was entirely compromised, it's never getting anything without the master password, and that's never sent across by the client. Then again, there's also the web interface.
- ronnier 1y agoYeah if an attacker was able to insert javascript then it's possible.
- blr_lpm 1y agoFor this particular threat vector, where the client is compromised, the backend doesn’t matter.
- franga2000 1y agoA compromised server can inject exfil code into the web page it serves. If you only ever use the apps then you should be fine though.
- 9cb14c1ec0 1y agoWhich is only possible if logging into the web client and not when using the bitwarden desktop app or browser extensions.