[GH-ISSUE #408] security against memory attacks? #235

New issue

Closed

opened 2026-03-03 01:27:04 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 01:27:04 +03:00

Owner

Originally created by @pdarcos on GitHub (Feb 21, 2019).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/408

Hi everyone,

Great project.

Has anyone read the latest report regarding password managers all being vulnerable to reading password in memory? https://www.forbes.com/sites/kateoflahertyuk/2019/02/20/password-managers-have-a-security-flaw-heres-how-to-avoid-it/

I wonder how bitwarden/bitwarden_rs would fare in this audit. Anyone have any more info?

Cheers

Originally created by @pdarcos on GitHub (Feb 21, 2019). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/408 Hi everyone, Great project. Has anyone read the latest report regarding password managers all being vulnerable to reading password in memory? https://www.forbes.com/sites/kateoflahertyuk/2019/02/20/password-managers-have-a-security-flaw-heres-how-to-avoid-it/ I wonder how bitwarden/bitwarden_rs would fare in this audit. Anyone have any more info? Cheers

kerem closed this issue

2026-03-03 01:27:05 +03:00

kerem commented

2026-03-03 01:27:06 +03:00

Author

Owner

@mprasil commented on GitHub (Feb 21, 2019):

I think this question needs to be asked upstream. We use upstream code for the client side.

Server itself (which is what bitwarden_rs does) only handles already encrypted data, so there isn't much to leak.

@mprasil commented on GitHub (Feb 21, 2019): I think this question needs to be asked upstream. We use upstream code for the client side. Server itself (which is what `bitwarden_rs` does) only handles already encrypted data, so there isn't much to leak.

kerem commented

2026-03-03 01:27:06 +03:00

Author

Owner

@mprasil commented on GitHub (Feb 21, 2019):

I'm going to close this, but feel free to reopen if you think this question is still relevant for some reason.

@mprasil commented on GitHub (Feb 21, 2019): I'm going to close this, but feel free to reopen if you think this question is still relevant for some reason.

kerem commented

2026-03-03 01:27:06 +03:00

Author

Owner

@dani-garcia commented on GitHub (Feb 21, 2019):

To add some extra info, all the clients have an option to auto-lock the vault that should remove the master pass from RAM. Other than that and using 2FA, there is no other solution, really. If an attackere has control of your devices you've already lost.

@dani-garcia commented on GitHub (Feb 21, 2019): To add some extra info, all the clients have an option to auto-lock the vault that should remove the master pass from RAM. Other than that and using 2FA, there is no other solution, really. If an attackere has control of your devices you've already lost.

kerem commented

2026-03-03 01:27:06 +03:00

Author

Owner

@pdarcos commented on GitHub (Feb 21, 2019):

@dani-garcia That's what I was thinking too.

Thanks for confirming. I've opened up a ticket in the BW repo about this since it is an upstream client side vulnerability. https://github.com/bitwarden/browser/issues/876

Cheers

@pdarcos commented on GitHub (Feb 21, 2019): @dani-garcia That's what I was thinking too. Thanks for confirming. I've opened up a ticket in the BW repo about this since it is an upstream client side vulnerability. https://github.com/bitwarden/browser/issues/876 Cheers

kerem referenced this issue

2026-03-03 08:36:30 +03:00

[PR #244] [MERGED] Make U2F work with vault 2.4.0 changes #2684