• jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    2
    ·
    6 months ago

    That’s a reasonable thing to do. But your supply chain could still be compromised, using a different front end increases the entire risk surface. If nothing else there’s less eyeballs looking at your front end. There could be IPC the front end uses to pass messages via other channels. It’s a larger threat profile.

    • lemmyreader@lemmy.mlOP
      link
      fedilink
      English
      arrow-up
      2
      ·
      6 months ago

      Okay. Would you recommend manually copy & paste and not use the Chrome or Firefox extension for Bitwarden ?

      • jet@hackertalks.com
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        6 months ago

        That’s down to you and your threat model. Look at the downside of a breach, and look at the convenience of the browser integration. And make the choice for yourself.

        For instance, if I was logging into a top secret military system, I would not use browser integration. That would be outside my threat model

        Not to mention copy and paste on many systems is very insecure. On desktop computers any application can copy from that buffer without you being aware of it. On telephones are getting better about letting you know when an app copied the copy and paste buffer. But it’s something you should model

        If you decide to type the password in manually, what else is listening to your keystrokes? If you’re running discord with a push to talk button. Discord usually gets to see everything that you type. Is discord part of your threat model?

        I bring these scenarios up just to illustrate that being aware of your threat model trade-offs and risk tolerance is important.