Bitwarden Moves into Passwordless Security

https://thenewstack.io/bitwarden-moves-into-passwordless-security/

by elorant • 3 years ago

14 3 3 years ago

badrabbit• 3 years ago

They moved into a fad. Be very careful and weary of any solution that is passwordless and will have you not use 2FA. Even a yubikey with a pin is significantly inferior to a yubikey and a different auth mechanism (password,device cert+pin,etc...)

Whatever better auth method they are selling, don't let it be reason to stop using passwords.

I'll give you a classic example: sysadmins set up ssh publickey login, they are now immune to brute force attacks so they use it all over the place. One admin exposes the private key in a public git repo and gets the whole company compromised. They could have used both passwords and public keys and stopped that compromise.

My point: 2 is always better than 1, even if it is a fancy new impenetrable and hyped up method of auth.

lsowen• 3 years ago

Better info directly from Bitwarden: https://bitwarden.com/blog/bitwarden-passkey-management/

hammyhavoc• 3 years ago

Does VaultWarden fit into this equation?

Bitwarden Moves into Passwordless Security

Related Stories