logoalt Hacker News

1024kbtoday at 3:22 PM5 repliesview on HN

I had a really bad experience with the bitwarden cli. I believe it was `bw list` that I ran, assuming it would list the names of all my passwords, but too my surprise, it listed everything, including passwords and current totp codes. That's not the worst of it though. For some reason, when I ssh'ed into one of my servers and opened tmux, where I keep a weechat irc client running, I noticed that the entire content of the bw command was accessible from within the weechat text input field history. I have no idea how this happened, but it was quite terrifying. The issue persisted across tmux and weechat sessions, and only a reboot of the server would solve the problem.

I promptly removed the bw cli programme after that, and I definitely won't be installing it again.

I use ghostty if it matters.


Replies

stvnbntoday at 4:05 PM

I love how the first comment is a complain having nothing to do with the actual subjec

show 2 replies
niccetoday at 3:43 PM

I thought that CLI would be efficent when I looked for using it and then I figured it is JavaScript

show 1 reply
trinsic2today at 3:29 PM

Wow. Thats crazy. Is there an extension for bwcli in weechat? BTW I didnt even know BW had a cli until now. I use keepass locally.

show 1 reply