TL;DR: It's definitely interesting, but this is about attacking vaults with biometric unlock enabled (and are thus stored on disk) on Windows, and requires workstation access and a Bitwarden design flaw that was fixed in April.
> the attack already assumes access to the workstation of the victim and the Windows domain
> The underlying issue has been corrected in Bitwarden v2023.4.0 in April 2023
> As it turns out, we were not the first to discover this in March 2023, it had already been reported to Bitwarden through HackerOne.[1]
I could have sworn [1] had a dedicated post here on HN but couldn't find it, it's worth a read too.
> the attack already assumes access to the workstation of the victim and the Windows domain
> The underlying issue has been corrected in Bitwarden v2023.4.0 in April 2023
> As it turns out, we were not the first to discover this in March 2023, it had already been reported to Bitwarden through HackerOne.[1]
I could have sworn [1] had a dedicated post here on HN but couldn't find it, it's worth a read too.
[1]: https://hackerone.com/reports/1874155