- At the request of @jonathansampson, here are a list of known issues while testing bitwarden v1.14.2 with Brave 0.18.14. This list is a WIP and will be amended as issues are found. #9437 Macbook Brave: 0.18.14 rev: ad92d029e184c4cff01b2e.
- Two of the most common password keepers on the internet are Bitwarden and 1Password. Fortunately, both have very polished, well supported Brave extensions. If you haven’t checked out either service, be sure to sign up to either and install the appropriate Brave extension.
I wanted to write up a quick blog post on something that I was rather upset about. That’s a change that was very badly communicated and caused people to click things they shouldn’t have without verification, but because it’s a “web app” they seem to be able to do these things.
Bitwarden is a free and open-source password management service that stores sensitive information such as website credentials in an encrypted vault. The Bitwarden platform offers a variety of client applications including a web interface, desktop applications, browser extensions, mobile apps, and a CLI.
And here is that issue: Extension disabled due to new permissions · Issue #1548 · bitwarden/browser · GitHub
and Bitwarden permission change warning on brave browser · Issue #1549 · bitwarden/browser · GitHub
Now I don’t have to explain why this was bad on so many levels, those of course being (1) the change that was really unneeded, (2) was not optional and (3) caused users icon to disappear.
It’s also not the fact that, yes they made it easy as it only required a click, and did not require admin permissions, but guess what…. this is exactly how getting compromised works. So when you attempt to educate end users not to do that, and stuff like this applies that there’s nothing wrong with something like “accept permissions” out of the blue!
Now I’m going to share some comments I 100% agree with from those issues from a lad called cleclap:
“Bitwarden is a highly sensitive security application managing 100 and more passwords. It is not a good idea to have this application require additional permissions to communicate with other applications. I rather take this as a worrying indication that the development of Bitwarden is turning into a bad and sad and wrong direction.
And, yes, Bitwarden should definitely make this additional request for permissions optional.
Where can I download the old version of the extension? I do not want this extension to operate with more permissions than is necessary for the most fundamental options.”
Now there’s a coupe dislikes and that could be due to the comment mentioned after by “github-account1111”
“@clecap I agree with the premise, but if security is important, then using older versions is counterproductive, as it leads to a potentially less secure environment than with an up-to-date version (even one that has more permissions).”
Now I will put my two cents in right here…. It’d not the same to mix features in with security, updates to features almost never brings additional security, it’s usually the opposite and in this case it is.
As again cleclap explains:
“@github-account1111 absolutely yes – provided the updates move into the right direction. Here I have, sorry to say, some serious doubts. While I certainly understand the convenience of all kinds of additional UI features and while I am certainly grateful that they exist they (1) definitely should be optional, (2) trade convenience for security, (3) were not reasonably communicated to end users and (4) came as a “oops, my system has been hacked” surprise to me.
And therefore my trust that updates move into the right direction of more secure software is, here, shaken.
All I want from a password store is to keep my passwords safe – and communicating them to “cooperating programs” by means of some “click ok or have your password store disabled” is the textbook example of what I am not expecting from secure system design. Sorry.”
I again have to 100% agree with him here. Now for the response from the “officials”?
| Hi All, We’ve been discussing fervently today internally around this, and while we’ve figured out a way to make this permission optional in chromium based browsers, obviously we won’t be able to do so in Firefox. After deliberation and discussion, and before our official product release announcement, we’ve decided that it would be better to exclude Firefox from browser biometric authentication, for now, until the upstream issue is resolved: https://bugzilla.mozilla.org/show_bug.cgi?id=1630415 rather than forcing all Firefox Bitwarden users to accept the new permission. Extension update will be published soon as we’re working on appropriate PRs to make this change, along with supporting documentation. Thank you for your feedback and continued support, patience and input, it’s extremely valuable and part of what makes open source amazing! Sincerely, |
OK? So…. because it couldn’t be optional on one platform it was worth the reduction in security for a bigger attack surface, so the feature was introduced “without say” to end users. That makes no sense when security should be the first and foremost from the product, not features.
Final Words.
This feels like a upper management making a poor judgment call due to peer pressure and stepping outside of the company’s mission statement. What a sad day….
Browse Faster
Load pages 3x to 6x faster
Watch Brave in action, head-to-head-to-head against Chrome and Firefox. Brave loads pages three times as fast out of the box with nothing to install, learn or manage.
This is a Vimeo video. You'll need JavaScript enabled to view this.
Switching Is Easy
Import and continue where you left off
It’s easy to import your settings from your old browser. You can do it during the welcome tour or later through the menus.
All of your old browser profiles will appear in a list. You can import other browser data through the main menu item called “Import Bookmarks and Settings.”
Give Some Back
Bitwarden Brave Browser
Support your favorite sites with Brave Rewards
Turn on Brave Rewards and give a little back to the sites you frequent most. Earn frequent flyer-like tokens (BAT) for viewing privacy-respecting ads through Brave and help fund the content you love
Browsing the web with Brave is free: with Brave Rewards activated, you can support the content creators you love at the amount that works for you.
Brave can automatically distribute your contributions based on how much time you spend on sites. Or, you can choose to tip sites directly, and even offer a fixed monthly tip amount.
All of this works while keeping your browsing history private. Your funds are made available to site owners through an anonymous ledger system, so you can’t be identified based on the sites you visit and support. Over 10,000 publishers and content creators have registered to receive Brave Rewards.
Remember: these contributions are optional – browsing the web with Brave is free.
Browse Safer
Experience unparalleled privacy and security.
Brave fights malware and prevents tracking, keeping your information safe and secure. It’s our top priority.
We’re not in the personal data business.
Our servers neither see nor store your browsing data – it stays private, on your devices, until you delete it. Which means we won’t ever sell your data to third parties.
Customize your shield settings
Choose your settings on a per-site or browser-wide basis. See how many ads and trackers are being blocked by Brave every day on the New Tab Page.
Security meets simplicity
Bitwarden Log In
If you’re willing to research, download, and install multiple extensions, and carefully configure and correctly maintain settings in both the browser and extensions, you can match some of Brave’s privacy and security.
Brave does all that work for you. Simple, right?
Whenever possible using the HTTPS Everywhere list, Brave automatically upgrades to HTTPS for secure, encrypted communications when an ordinary browser would use an insecure connection.
Defaults that matter
Browse confidently with default settings that block phishing, malware, and malvertising. Also, plugins, which have proven to be a security risk, are disabled by default.
Sync your devices bravely
Brave Sync, currently in beta, can be enabled to encrypt and synchronize your preferred settings and bookmarks. However, Brave does not have the keys to decrypt your data.
Our Features
Brave Browser Feature List
Shields
- Ad blocking
- Fingerprinting prevention*
- Cookie control*
- HTTPS upgrading*
- Block scripts*
- Per-site shield settings
- Configurable global shield defaults
Security
- Clear browsing data
- Built-in password manager
- Form autofill
- Control content access to full-screen presentation*
- Control site access to autoplay media
- Send “Do not track” with browsing requests
Brave Rewards
- Earn by viewing private ads
- Tip your favorite creators
- Contribute monthly to sites
- Auto-contribute to sites
- Verify with Uphold and move funds in and out of your wallet
- Become a verified creator and start earning BAT from tips, contributions and referrals
Tabs & Windows
- Private Windows
- Pinned Tabs*
- Auto-unload*
- Drag and drop*
- Duplicate*
- Close Options
- Find on page
- Print page
IPFS Integration
- Browsing without intermediaries
- Access content directly from the IPFS network
- Resolve
ipfs://URIs natively or via a gateway - Install a full IPFS node in one click
Address Bar
- Add Bookmark
- Autosuggest URLs
- Search from address bar
- Autosuggest search terms
- Show/hide bookmarks toolbar*
- Show secure or insecure site
Extensions/Plugins
How To Use Bitwarden
Brave Desktop now supports most of the Chrome extensions in the chrome web store
Brave Firewall + VPN
(paid feature, iOS only)
Bitwarden Extension Edge
Unlike many browsers that offer VPNs which mask a user’s IP address, Brave’s Firewall + VPN, powered by Guardian, offers enhanced security and privacy by encrypting and protecting anything users do while connected to the Internet.
Learn more about Brave Firewall + VPN
- Block trackers across all apps
- Protects all connections
- We never share or sell you info
- VPN server does not know who you are
*Features marked with an asterisk are pending on one or more platforms.
Have Questions?
Visit the FAQ