Hunting for Bitwarden master passwords stored in memory

by markuta on 7/4/2023, 8:20:16 AM with 2 comments

  • by donmcronald on 7/4/2023, 5:54:23 PM

    I wonder if there's any difference if you use the option to sign in with Windows Hello using a TPM. What about logout vs lock?

  • by tentacleuno on 7/5/2023, 11:35:57 AM

    I'm guessing they've built the desktop client in JavaScript. One disadvantage of the language (and all similar ones!) is that the GC isn't deterministic. Without access to Node's gc() API, it's very hard to ensure the credentials are wiped from memory after locking.