All articles

Passbolt security audit 2021 - Part 1

4 min. read

Passbolt team

Passbolt team

22 April, 2021

Report conclusions

The cryptography of the project was examined by two members of Cure53 over the course of six days, with the results amounting to seven findings of varying severity and seven informational findings.

Despite the relatively large number of findings, all findings were written from a critical perspective of the specification, and therefore do not necessarily have a practical impact on the software implementation for Passbolt.

PBL-01–001 and PBL-01–004, which deal with transport layer encryption as well as nonce generation and management for authentication operations, were marked as high severity because they outline omitted information in the provided specifications that could cause implementation decisions to be made with high potential security impact. PBL-01–002, PBL-01–005, and PBL-01–009 also deal with undefined behavior in the specifications, but which [have] less severe potential consequences on software implementations.

The remainder of the issues, most of which are informational-severity, deal with recommendations towards hardening the specification without touching upon any details that could have a current tangible security impact on the security of the Passbolt cryptographic design. In conclusion, while Passbolt’s existing cryptographic specification design could benefit from clearer and more complete definitions in certain areas (as outlined in this report), the specification itself illustrates a relatively well-designed protocol with no immediate outstanding security issues.

Some comments on the high ranked issues

Conclusion

Continue reading

Passbolt is “Made in Luxembourg”

3 min. read

Passbolt is “Made in Luxembourg”

Passbolt is located in Luxembourg, at the heart of Europe, where data privacy matters and is protected by the law.

Passbolt team

Passbolt team

27 April, 2021

How we migrated Passbolt front-end to React

8 min. read

How we migrated Passbolt front-end to React

This article will give you an overview of this React migration journey. Most of the discussed technical details come from the style guide repository.

Passbolt team

Passbolt team

11 February, 2021

Flag of European UnionMade in Europe. Privacy by default.