server

I don't know about the rumours, but "a few days" is a long time to test a bug fix. It should ideally take from a few seconds to a few minutes. That's not extremely excellent, it's just good practice. More than that and it hints towards heavy reliance on manual testing, and that's something I'd be worried about. EDIT: Despite the parent comment's misguided logic, it seems his/her fears are actually in the right place. An issue was opened about 6 weeks ago asking where the tests are and it received zero responses from the maintainers: https://github.com/bitwarden/core/issues/399

Question about bitwarden: I found this issue saying there are no tests. https://github.com/bitwarden/core/issues/399 Also in the comments here someone said there are no tests. Does anyone have any info about that? I am interested in the software but no tests would be worrying. (Had no time to browse the code yet.)

I use 1password regularly, tried bitwarden, found it lacking in various quality of life features & polish that 1p has, so I didn't migrate. This is kind of yikes for a password manager too: https://github.com/bitwarden/core/issues/399 But it's also pretty much the only polished open source password manager there is out there. For now I'll be sticking with 1password, but might check out bitwarden again once they have tests and more maturity as a password manager.

> Wondering how they will address the current cryptographic scheme though. The only cryptographic weakness Cure53 identified was that a malicious API server could exfiltrate encryption keys. Cure53 deemed it a hard problem to solve. I wrote a proposed strategy for mitigating it: https://github.com/bitwarden/core/issues/392 Regarding Bitwarden's cryptographic security, a cursory read through their code yields the following: * It's using RSA-OAEP to encrypt AES keys (EDIT: formerly "some data") https://github.com/bitwarden/jslib/blob/b4fad203b94da53d3369... * It's using AES-256-CBC https://github.com/bitwarden/jslib/blob/b4fad203b94da53d3369... + https://github.com/bitwarden/jslib/blob/b4fad203b94da53d3369... + https://github.com/bitwarden/jslib/blob/2045e7047a66599b2c8a... It doesn't appear to be authenticating the AES-CBC-encrypted cipher

There's a bounty program but AFAIK there hasn't been an audit yet: https://github.com/bitwarden/core/issues/27

> Open source but we have to pay licenses for the database if we want to self host. As Bitwarden states in the core readme (https://github.com/bitwarden/core#requirements) "These dependencies are free to use." And if you lookup the licensing on MSFTs website (https://www.microsoft.com/en-us/sql-server/sql-server-2017-p...) you can see that the SQL Server Express version is free. Note: No, I'm not an MSFT employee and not related in any way to the mentioned company. I'm just a (not so regular) human being who first looks up information before posting statements.

https://github.com/bitwarden/core/blob/master/README.md SQL Server 2017, really? Interesting choice. Open source but we have to pay licenses for the database if we want to self host. I wonder what was wrong with PostgreSQL or MySQL even if they're using .NET Core as a language. Edit: there is an issue for that https://github.com/bitwarden/core/issues/10

I've been interested in migrating to bitwarden for a while, but I've been hesitant because I don't know how much I can trust it. Mostly, I was looking for an independent security audit. I took another look today and found a GitHub issue on the subject [1] and they're working with researchers on HackerOne [2]. [1] https://github.com/bitwarden/core/issues/27 [2] https://hackerone.com/bitwarden

I don't see anything wrong, but will add: Bitwarden has a desktop app(electron .. sigh but is cross-platform) and has integrations with all the major browsers (Safari, Firefox, Chrome, IE) Bitwarden also has Mobile support (iOS, Android & UWP). KeepassXC only does Chrome(and family) and Firefox I believe. Running your own bitwarden server is not difficult, and there are 3 implementations that I know about: The original .NET: https://github.com/bitwarden/core The Ruby one: https://github.com/jcs/bitwarden-ruby/ The Go one: https://github.com/VictorNine/bitwarden-go