Comment on Microsoft backpedals: Edge to stop loading passwords into memory

aeronmelon@lemmy.world ⁨12⁩ ⁨hours⁩ ago

• favoredponcho@lemmy.zip ⁨10⁩ ⁨hours⁩ ago

  Why does Bitwarden do it then?

  source

  • terabyterex@lemmy.world ⁨9⁩ ⁨hours⁩ ago

    i want to be clear whats going on here. every other password manager loads the password you are rewuestion (they have to)… edge, on startup, loaded every single password in memory to be accessed. every… single… one.

    bitwarden does not do that.

    source

    • favoredponcho@lemmy.zip ⁨9⁩ ⁨hours⁩ ago

      I think the only difference is the “on start up” piece. Bitwarden doesn’t load unencrypted contents in to memory on startup, but the moment you unlock your vault, all of its contents are dumped into memory in plaintext. It’s not like it decrypts one password at a time on request. When your vault is relocked, it’s supposed to purge the unencrypted contents from memory.

      A Bitwarden moderator explains this in a blogpost:

      When the vault is unlocked, all of the vault contents exist in a decrypted state in the process memory. In rare cases, your master password or PIN can also be found in the process memory.

      community.bitwarden.com/t/…/2

      source