Bitwarden flaw can let hackers steal passwords using iframes

Discussion in 'other security issues & news' started by Malcontent, Mar 9, 2023.

  1. Malcontent

    Malcontent Registered Member

    Joined:
    Dec 30, 2005
    Posts:
    638
    Location:
    Cleveland, Ohio USA
    Bitwarden flaw can let hackers steal passwords using iframes
     
  2. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    18,178
    Location:
    The Netherlands
    I believe this was also a problem with browser's built-in password managers. Weird that this still hasn't been fixed somehow.
     
  3. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,549
    Location:
    U.S.A. (South)
    I had thought it was a fairly strong manager too but................
     
  4. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    18,178
    Location:
    The Netherlands
    I don't think this is a problem that only affects Bitwarden, I believe it's more about the way browsers work. However, you would think that this stuff is fixable.
     
  5. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    9,199
    Location:
    USA
    Yeah, sounds like a browser issue. Iframes would be cool in a world without any bad people, but so would ActiveX and many other technologies that are convenient but exploited by thieves that are too lazy to work and mean people that think it's funny.
     
  6. Azure Phoenix

    Azure Phoenix Registered Member

    Joined:
    Nov 22, 2014
    Posts:
    1,568
    Bitwarden’s fix

    https://www.ghacks.net/2023/03/17/b...ssue-that-could-be-exploited-to-steal-logins/

     
  7. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    18,178
    Location:
    The Netherlands
    Yes, seems like a good solution and makes you wonder why they didn't think of this before.

    Yes, I wonder if browser built-in password managers have tackled this problem, probably not, so it remains a risk.
     
  8. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    9,199
    Location:
    USA
    I'd trust most 3rd party password managers before the ones in the browser(s). If someone left their PC unattended you can just look at the passwords in Firefox.
     
  9. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,549
    Location:
    U.S.A. (South)
    True. Just like Shockwave Flash/Adobe which i spent years perfecting automation projects with until they became exploitable by stupid intruders. However on my Windows 8.1 on offline and some Online i still use flash files i crafted to carry out convenient and creative local automations on my computers. I will never give them up.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.