🇨🇦

  • 3 Posts
  • 106 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle



  • Interesting, that I was not aware of. I’ve never run into a scenario where I’ve had to add/edit while offline.

    When using vaultwarden however, you can be offline as long as the client can still reach the server (ie they are within the same lan network or are the same machine). You’d still be fine to add/edit while your home wan is out for example, just not on the go.

    Plus there’s the no-internet package mentioned in that link, but it’s limited to the desktop application.


  • Bitwarden is (primarily) a single db synced between devices via a server. A copy is kept locally on each device you sign into.

    Changes made to an offline copy will sync to the server and your other devices once back online. (with the most recent change to each individual item being kept if there are multiple changes across several devices) /edit: the local copy is for access to your passwords offline. Edits must be made with a connection to the server your account resides on, be that bitwardens or your own.

    If you host your own sync server via vaultwarden, you can easily maintain multiple databases (called vaults) either with multiple accounts, or with a single account and the organizations feature. (options for creating vaults separate from your main one and sharing those vaults with multiple accounts) You can do this with regular bitwarden as well, but have to pay for the privilege.

    Using vaultwarden also gives you all the paid features of bitwarden for free (as it’s self-hosted instead of using public servers)

    I’ve been incredibly happy with it after setting it up ~3 months ago. Worth looking into.




  • First of all, they have to already know you have that device.

    Ie: any amazon smart device; which are becoming increasingly popular and found in many homes globally.

    Also, I’m not taking about someone targeting me, you, or anyone specifically. I’m talking about someone wandering around looking for homes that happen to have a vulnerable device and seeing where they can get from there.

    Really not hard to find.

    THEN they have to hang around long enough for any sort of updates and shit to happen.

    Trivial when you consider not everyone lives in a single-family home with significant yardspace around it. Apartments exist, so do smaller multi-family dwellings.

    THEN THEN they have to try and figure out how to get any useful data from this connection

    The useful info here being your WIFI password (the info this connection is intended to spread) allowing an attacker to piviot to the rest of your network.

    THEN THEN THEN they have to find a way to remove said useful information to a device that can actually store it.

    This would be where I’ve repeatedly talked about an attacker being able to purchase an amazon device, jailbreak it, and use it to connect to your network

    They can buy a device from Amazon then have all the time in the world to figure out a method of retrieving data from it. Once a method is worked out, they then deploy it against unsuspecting victims. (ie any random home they can get near and find an amazon device thats broadcasting looking for new devices)

    if someone is able to just walk up to your house with a random device and hang out long enough to establish a wifi connection and pull out any sort of useful data you have WAY BIGGER PROBLEMS

    I completely agree which is why I’m not happy with Amazon providing a hole to achieve exactly that.


  • Yes, that is exactly what I’m saying as that’s what it sounds like.

    If you can buy a new amazon device and have it connect to all your stuff without your input; what stops someone else buying an amazon device and connecting to your network with it?

    Obviously I’m not worried about the device I actually receive; I’m concerned that someone can buy their own device and use it to connect to other people’s networks via existing amazon devices.


  • Depending on a setting being disabled thats more than likely on by default isn’t much comfort. Most people won’t know about or look for those kinds of settings, especially with the deceptive descriptions often used for features like these.

    To be clear, I don’t use these devices either; I’m just concerned for those that don’t know any better.

    The verification still needs one of the devices listed in my post to be active on your wifi to allow the setup and communication.

    Yes, that’s what I said; your amazon devices are giving away your wifi info to new devices. As in once you’ve allowed an amazon device onto your network, any new device can add itself to that network via your existing device without your input.

    This happens before the new device has authenticated into your amazon account as it doesn’t yet have an internet connection (ie before its proven to be your device and not say a neighbours) and before you manually provide authentication for your wifi. Hence the ‘with 0 auth’.

    The auth is likely done by device to device handshake. Its just that there isn’t a human involved.

    A handshake between a device you own but have little control over and a device you’ve never seen before, may not have physical access too, and that could have been compromised before requesting your info. Great.

    I’m not saying they’re beaming it out in plain text for all to read; just that they’ll give your info to a device you may not even be aware of let alone own or have any control over. That device may be a stock Amazon device, or it could be something more malicious.



  • Hmm

    Two possibilities:

    Is the old device still plugged in while you setup the new one? Perhaps they connected to each other. My previous Samsung phone did this with my new one without prior setup of the ‘feature’, though after I signed into my Samsung account onnthe new phone.

    Or it could have come pre-loaded with data on your account…

    I’m not very comfortable with either option really.










  • They do sometimes; but they also comply with takedown notices. Thing is, they all mirror each other’s data and are located globally. Take one down, 2 more pop up outside your jurisdiction; and files that get taken down are only taken from one provider at a time, while others pick up the slack. It’s an endless game of wack-a-mole that’s essentially a waste of time.

    This is why it’s somewhat important to have more than one provider in seprate jurisdictions but not absolutely critical. You can move from one to another pretty seamlessly.