I stumbled over bitwarden, a service that promises to provide a service like LastPass (all data encrypted on your device, but additionally stored on a central server for easy access).
I am not talking about the price tag but about security: does anyone have any insight of the process? Is it really as secure as they claim?
Everything seems to be found in github, but I am not good enough as far as security goes (and as developer) to come to a decision.
I do not ask for a code review (and of course neither for any form of endorsement), but more for some insight of "Beware, I looked into it, and it is probably/obviously unsafe, because ..."
I am trying to formulate my concerns:
- anybody can start such a project and say "we handle it as securely as possible"
- verification of this claim requires a code review, which I cannot expect at this time
- I was hoping someone might already have had a look into the overall organization of the project (i.e. are there any obvious flaws?)
- The claims/promises sound a little "too good to be true", especially as they provide hosting of the encrypted data for free
We all know "If it sounds too good to be true it probably isn't true"