I stumbled over bitwarden, a service that promises to provide a service like LastPass (all data encrypted on your device, but additionally stored on a central server for easy access).

I am not talking about the price tag but about security: does anyone have any insight of the process? Is it really as secure as they claim?

Everything seems to be found in github, but I am not good enough as far as security goes (and as developer) to come to a decision.

I do not ask for a code review (and of course neither for any form of endorsement), but more for some insight of "Beware, I looked into it, and it is probably/obviously unsafe, because ..."

I am trying to formulate my concerns:

  • anybody can start such a project and say "we handle it as securely as possible"
  • verification of this claim requires a code review, which I cannot expect at this time
  • I was hoping someone might already have had a look into the overall organization of the project (i.e. are there any obvious flaws?)
  • The claims/promises sound a little "too good to be true", especially as they provide hosting of the encrypted data for free
    We all know "If it sounds too good to be true it probably isn't true"

closed as off-topic by schroeder Dec 22 '17 at 18:29

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.