Hacker News Reader

If you scroll down, it appears that Bitwarden sends BasicAuth passwords in the clear over HTTP. This is a huge security hole, far bigger than the subdomain one.

View on HN

It’s certainly an issue, but sending it over basic auth isn’t one of them. If the passwords were submitted via a login form (POST request), you can also read it over the wire.

With HTTPS, you can read the request only in the context of the browser.

You can't MITM (via Wireshark and similar tools, or over the network), unless you have a root certificate and override the website's certificate with it (assuming the browser allows root certificates, and Firefox can be configured to not allow custom root certificates). So no, not the same thing at all.

And if you meant that in the context of HTTP-only, well, arguably password managers should warn before autocompleting unsecure forms, and browsers should warn before sending the request.

BasicAuth is a plain text header, there is no other way to send it. Are you meaning it should only allow Basic Auth over https and refuse to login over http?

Reply on news.ycombinator.com