jslib VS platform-compat

Someone should tell them!

https://github.com/bitwarden/jslib/issues/52

To that extent, they're not going to bother trying to brute force the original password with aaaaaaa, aaaaaab, aaaaaac, etc. they'll start by going through the very publicly known word list and try abacus, abdomen, abdominal, etc.

FYI, according to the implementation notes in the .1pux importer pull request , the 1Password categories should be mapped to Bitwarden categories as follows:

In 2021, there was a PR (bitwarden/jslib#404) that changed it from 1 to 2 for local authentication. Server authentication still uses 1 iteration.

As a point of interest, there are 7,776 unique words in the word list. As such, each word provides log2(7776) ~= 12.92 bits security. So the 4 word phrase Bitwarden generates by default only provides ~51 bits security (your 3 word phrase about 38 bits).

The code you're interested in is here: https://github.com/bitwarden/jslib

Fixes and improvements to MykiCsvImporter by djsmith85 · Pull Request #707 · bitwarden/jslib (github.com)

DotNet offers the SecureString class to keep a string encrypted in Memory, but as long as the OS does not natively support this concept, the only advantage is that it resides in memory for a shorter time, the disadvantage is that SecureStrings are easier to search for.

Note the KeePass's resistance to the attack mentioned depends on the security of .NET's secure string, which, here's what Microsoft has to say about it (https://github.com/dotnet/platform-compat/blob/master/docs/D...)

As for KeePassXC, last I checked it didn't even bother.

TIL. Looks like the deprecation note recommends MailKit.

Well of course, but it does have to be passed to the module that generates the hashes AD uses in the first place. And as I said, the standard password reset screen is bound to store the password in plain text somewhere as well.

This won’t help you with your question, but I figured I should warn against using send-mailmessage.

points you here.

Some of the reasons for not using Hashtable or other non-generic collection types are outlined here. That's why Microsoft doesn't recommend their usage in new implementations across all of its API documentation.

And if you really want to be secure you need to something better than a SecureString: https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md