Bitwarden Encrypts Your Data
huy.rocks
huy.rocks
Speaking of which, I presume Huy doesn't work for Bitwarden, so it's unfortunate they needed some independent blogger to write up their auth scheme. I do realize there's an independent implementation in Vaultwarden, so that's almost better than a spec -- just as long as Vaultwarden was a clean-room impl and thus reading that code is "legally safe."
That's kind of a odd statement, no?
The information is provided by Bitwarden and easily found, for example:
* https://bitwarden.com/help/what-encryption-is-used/
* https://bitwarden.com/blog/end-to-end-encryption-and-zero-kn...
So maybe you found it to be an odd statement, I dunno, but I stand by that it is unfortunate that they needed someone independent person to dive into that level of technical detail
> (c) Bitwarden, Inc. CONFIDENTIAL
well, that's a weird thing to put in a white paper
Vaultwarden is a server implementation, though.
As the article also points out, the *warden server is little more than a basic REST API, all the cryptographically fun parts happen on the client side, for which there are only the official implementations so far.