Bitwarden CLI - Get passwords, username, TOTP and more from Bitwarden

[dood 3]

15 hours ago, deanishe said:

 

This. If you care who your apps are talking to, I can't recommend Little Snitch enough. I'm really annoyed Apple have changed Big Sur so that Apple's own programs can bypass 3rd-party firewalls.

 

 

@deanishe – According to Patrick Wardle, the macOS 11.2 beta 2 suggests that Apple is removing this policy going forward! 

 

And kudos to @blacs30 for an awesome workflow!

[blacs30 4]

7 minutes ago, dood said:

@deanishe – According to Patrick Wardle, the macOS 11.2 beta 2 suggests that Apple is removing this policy going forward! 

 

Thanks for this update. That was the reason for me not to update yet. So I'll wait for 11.2 to be released.

[paulw 15]

8 hours ago, blacs30 said:

Secure note content is hidden in the workflow and is treated like a password.

 

Ah, ok, thanks for explaining that. I suppose viewing the secure note content in the workflow would compromise security you've built into the app? What about an option to "View in Bitwarden"—whether the Desktop app or online?

[paulw 15]

On 1/13/2021 at 1:56 PM, deanishe said:

All in all, very well done. @blacs30 is very security aware. I would trust this workflow much more than the browser extension, which was written—at least in part—by idiots.

@deanishe Could you explain the "idiots" comment re the Bitwarden browser extension? I looked through the linked discussion, but I'm not savvy enough to understand what the problem is.

[lmrdaddy 4]

I guess they were referrring to

Quote

For the browser extension, all vault data is stored using the chrome.storage API. [...] chrome.storage is considered an unprotected data storage medium since it's just plainly on the client disk. [...] Currently the browser extension also stores the encryption key in chrome.storage.

 

So storing both the encrypted data and the en-/decryption key in the same unprotected storage ("plainly on disk") is indeed a horrible idea. Storing it in a place that is potentially vulnerable to direct access via malicious websites in case the browser itself is attackable via a browser vulnerability is another issue. The latter is the reason why it is generally not the best idea to use a browser's own password management feature.

[paulw 15]

Got it, thanks for explaining. Good to know also about why not to use a browser's password management as well.

 

The convenience of the Bitwarden browser extension is nice. Do you think the developers' blunder is enough not to trust using it now?

[lmrdaddy 4]

15 hours ago, paulw said:

Good to know also about why not to use a browser's password management as well.

It is (in my opinion) still way better than not using a password management at all. 

 

15 hours ago, paulw said:

 

The convenience of the Bitwarden browser extension is nice. Do you think the developers' blunder is enough not to trust using it now?

I am not really in a position to judge that. The github issue is more than 4 years old, so I hope they learned something since then. Personally, I am using the Firefox extension without having investigated any closer, I'm trusting (perhaps wrongly so) that a security company does at least a few things right.  

[deanishe 1,397]

16 hours ago, paulw said:

Do you think the developers' blunder is enough not to trust using it now?

 

I think so. Most of the code is re-purposed from the web frontend. I use it, in any case.

 

16 hours ago, paulw said:

Good to know also about why not to use a browser's password management as well.

 

They're at least as safe as a browser extension, and arguably better than copy-pasting passwords from another app.

 

The main advantage of a standalone password manager is that you can put more than just website passwords in there.

[paulw 15]

@deanishe@lmrdaddy, thanks for that info and feedback. I'm continuing to use it. And this workflow, as well.

[jpizzle 0]

Is it possible to save the query and repopulate it on the next trigger? Trying to avoid having to research every time to copy password after copying username

@blacs30

[jim465 0]

@blacs30 Hi there, thanks for the script. It was working great until the other day, when i tried to update the secrets. I don't seem to be able to log back in again properly. I get the follow ing error message:

 

Error: dyld: Library not loaded: /usr/local/opt/icu4c/lib/libicui18n.67.dylib
  Referenced from: /usr/local/bin/node
  Reason: image not found

 

Can anyone tell me what I have done wrong and, more importantly, how to fix it 🙂

 

[blacs30 4]

25 minutes ago, jim465 said:

@blacs30 Hi there, thanks for the script. It was working great until the other day, when i tried to update the secrets. I don't seem to be able to log back in again properly. I get the follow ing error message:

 

Error: dyld: Library not loaded: /usr/local/opt/icu4c/lib/libicui18n.67.dylib
  Referenced from: /usr/local/bin/node
  Reason: image not found

 

Can anyone tell me what I have done wrong and, more importantly, how to fix it 🙂

 

@jim465

This issue looks unrelated to the workflow itself but related to either the node or bitwarden-cli installation itself.

How did you install bitwarden-cli, via brew or npm?  I assume that a simple bw command like `bw -v` will fail as well? Try reinstalling it.

[deanishe 1,397]

29 minutes ago, jim465 said:

Can anyone tell me what I have done wrong and, more importantly, how to fix it

 

Your Homebrew Node is out of whack with its dependencies. Reinstall it by running this command in a shell:

 

brew reinstall node

 

Might be a good idea to run brew update first, or even brew upgrade to install the latest versions of everything (which should also fix the issue).

Edited 5 hours ago by deanishe