Bitwarden Heist - How to Break Into Password Vaults Without Using Passwords
blog.redteam-pentesting.de
Sometimes, making particular security design decisions can have unexpected consequences. For security-critical software, such as password managers, this can easily lead to catastrophic failure: In this blog post, we show how Bitwarden’s Windows Hello …
  • _edgeEnglish
    1·
    11 months ago

    Short version: Windows Hello and AD failed as designed. The domain controller can recover secrets “protected with biometrics”. The DC was compromised in the scenario.

    Bitwarden implements biometrics now differently on Windows, keeping the domain controller out of the loop.