'The steps in the provided description of the fix should address the external iframe handling as the user is now in control of which iframes are filled by the extension (as opposed to filling all iframes by default). “I highly appreciate that the vendor decided to address this security issue,' said Sven Krewitt, senior vulnerability researcher at Flashpoint. IT Pro has asked the company why it decided to release the fix now even though it has known about the issue since 2018. This video shows a quick run-through illustrating how quick and easy deploying Bitwarden to your own server is. We provide Bash and PowerShell scripts that make this very simple. “This eliminates the iframe attack vector while still allowing convenient autofill functionality for sites that have trusted iframes,” a spokesperson from Bitwarden told IT Pro. Thats when I found out the server of BitWarden was written using Microsoft technologies, C (yeah, its mostly open source, but its dirty to me due to its. Bitwarden can be easily deployed cross-platform with Docker on Linux, macOS, and Windows machines. Personally, I’ve been using Bitwarden as my password manager across multiple devices for several months now. You might remember that earlier we listed it as one of the best password managers available for Linux.

If a user fills in an untrusted iframe when using manual autofill, the password manager will flag an alert into the URI or URL to let the user decide whether to cancel or proceed with the operation. Bitwarden is a free and open-source password manager.

These trusted domains include the same domain as a website or a URL the user has designated as safe.īitwarden said that autofill on page load remains 'off' by default. The password manager will only fill in iframes from trusted domains if a user enables autofill on page load.

Bitwarden open source