Windows Credentials manager has Bitwardens credentials in it...What? Why? Is this a security issue?!?

[Quexten]

@mmja

Why isnt local cached copy encrypted with additional key that is stored in Bitwarden servers and only downloaded against cryptographically secure challenge against the user? Then the attacker gaining access to the database locally would not only need that key from the servers but also the users passphrase/Hello token to decrypt it. Then it would not be protected with “just” users passphrase/Hello token, but also something that is only in the server and that needs to be downloaded to gain access to the local database. When user locks the session on Bitwarden, closes the Bitwarden or logs out of Bitwarden, that key would be desroyed in memory and would have to be redownloaded from the server.

Offline access is specifically a supported and expected feature. The above scheme no longer allows offline access. So this could be an additional security feature, but would have to be opt-in.

It would be much better to have two-layer encryption to local database at rest anyway.

I agree. It just has not been implemented so far.