Storing Master Password for Bitwarden in Bitwarden itself

[grb]

@_Michael

Is it still going to take forever to crack due to the KDF iterations or whatever?

As I explained previously — yes, it’s going to take thousands of GPU-years and millions of dollars:

Evaluating Master Password Security: How Many Bits Are Enough for Economic Safety?

I would not trust ChatGPT on this. I do generally trust the Passwordbits site, but its cost estimates are based in part on data from a 1Password blog that is not fully transparent in its methodology; in addition, the method used to extrapolate from PBKDF2-SHA256 hashing to Argon2id, while not unreasonable, is tied to the hardware used by the blog author (which has not been reported). The calculations are not that difficult, but the results are dependent on assumptions made. Aaron Toponce has…