Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden – Open Source Password Manager

bitwarden.com

Post reply on HN
Print view View original

51–60 of 163 posts

Re: Bitwarden – Open Source Password Manager

#51

Post by number6 »

bad_user wrote: post #48
jhabdas wrote: post #42

For years I've discouraged use of clouds for storing passwords. But because Bitwarden is FOSS software, encrypts data on the client, has good cross-platform support, and can operate if the company goes out of business they have won me over for the storage of secrets I'm not reserving for the sneakernet.

Last time I checked Bitwarden was not encrypting data on the client. Did that change? Also, OSS does not mean secure. Without audits from security experts, I can’t trust it. Bitwarden is objectivity less secure than 1Password or Keepass actually, at the very least because it doesn’t have a desktop application.

Bitwarden has a desktop client.

If you are hosting it on your private server does it change your outlook on its security?

Re: Bitwarden – Open Source Password Manager

#52

Post by bad_user »

ReverseCold wrote: post #17
albertop wrote: post #15

First paragraph on their page disqualifies it completely. I do not want my passwords on anybody’s servers. Our secure cloud syncing features allow you to access your data from anywhere, on any device! Your vault is conveniently optimized for use on desktop, laptop, tablet, and phone devices.

> I do not want my passwords on anybody’s servers. What about your own server? https://help.bitwarden.com/article/install-on-premise/

It’s expensive to setup, if you need to rent a VPS it’s going to cost $5 per month which is probably the most expensive option and if you can’t trust somebody else’s server, you definitely CANNOT trust your own VPS ;-)

Re: Bitwarden – Open Source Password Manager

#53

Post by kadoban »

kryogen1c wrote: post #47
keehun wrote: post #35

Earlier quoted context omitted.

Maybe it's just my phone (6) but you may find that once you get 1000+ logins, Bitwarden falls apart pretty quickly. I've heard the same from people with 800+ logins. I remember it used to be very quick when I initially used it with a few plugins. IIRC from their Github issue threads, Bitwarden is using Xamarin, and performant UI has been a consistent struggle with many login entries.

how in God's name do you end up with _thousands_ of logins, or even 800? I work in a pretty large MSP in IT with tons of different programs, websites, and clients. Even if I added every single password (which I most surely would not do), I can't imagine there being more than two or three hundred. Conservatively, if every of two hundred clients has thirty passwords, that's still only 600.

Two hundred times thirty is 6000

Re: Bitwarden – Open Source Password Manager

#54

Post by anotherevan »

rosege wrote: post #49
anotherevan wrote: post #46

I recently switched to BitWarden from Lastpass after trying a few different options including pass, Enpass and KeePass options. 95% of my usage is in the desktop browser, and the UI of their add-on is great, IMO. Lastpass' had been getting worse for some time, and their shuttering of Xmarks finally left me with no good reason to stay. Using the add-on with Firefox on my phone is reasonable, although could be a bit be…

Was the data transfer easy between the 2? I'm thinking of doing the same.

Yes, it was very easy. Just follow the instructions from here: https://help.bitwarden.com/article/import-from-lastpass/

Re: Bitwarden – Open Source Password Manager

#55

Post by bad_user »

number6 wrote: post #51
bad_user wrote: post #48

Earlier quoted context omitted.

Last time I checked Bitwarden was not encrypting data on the client. Did that change? Also, OSS does not mean secure. Without audits from security experts, I can’t trust it. Bitwarden is objectivity less secure than 1Password or Keepass actually, at the very least because it doesn’t have a desktop application.

Bitwarden has a desktop client. If you are hosting it on your private server does it change your outlook on its security?

No, it’s worse.

Re: Bitwarden – Open Source Password Manager

#56

Post by cjh_ »

bad_user wrote: post #48
jhabdas wrote: post #42

For years I've discouraged use of clouds for storing passwords. But because Bitwarden is FOSS software, encrypts data on the client, has good cross-platform support, and can operate if the company goes out of business they have won me over for the storage of secrets I'm not reserving for the sneakernet.

Last time I checked Bitwarden was not encrypting data on the client. Did that change? Also, OSS does not mean secure. Without audits from security experts, I can’t trust it. Bitwarden is objectivity less secure than 1Password or Keepass actually, at the very least because it doesn’t have a desktop application.

> Since all of your data is fully encrypted before it ever leaves your device, only you have access to it. Not even the team at Bitwarden can read your data, even if we wanted to. Your data is sealed with end-to-end AES-256 bit encryption, salted hashing, and PBKDF2 SHA-256.

From the linked page (https://bitwarden.com/)

Re: Bitwarden – Open Source Password Manager

#57

Post by cjh_ »

albertop wrote: post #15

First paragraph on their page disqualifies it completely. I do not want my passwords on anybody’s servers. Our secure cloud syncing features allow you to access your data from anywhere, on any device! Your vault is conveniently optimized for use on desktop, laptop, tablet, and phone devices.

The 'point' of solutions in this space is that they allow password access across devices. They use end-to-end encryption and support self hosting, what else could they do?

Re: Bitwarden – Open Source Password Manager

#58

Post by ivm »

keehun wrote: post #35
philliphaydon wrote: post #29

Earlier quoted context omitted.

> I still felt its sluggish performance on launch/search/sync was slowing me down a lot throughout the day. I recently switched (maybe 5 weeks or so, ago, from 1Password to Bitwarden, after finding out about it on HN) I imported ~400 odd logins from 1Password, I honestly don't find it any slower than 1 Password. I did notice that with Discord, both 1Password and Bitwarden now integrate with the new iOS password apis.

Maybe it's just my phone (6) but you may find that once you get 1000+ logins, Bitwarden falls apart pretty quickly. I've heard the same from people with 800+ logins. I remember it used to be very quick when I initially used it with a few plugins. IIRC from their Github issue threads, Bitwarden is using Xamarin, and performant UI has been a consistent struggle with many login entries.

Not Xamarin but Xamarin.Forms, basic Xamarin doesn't have issues with UI performance.

Re: Bitwarden – Open Source Password Manager

#59

Post by etu »

shakna wrote: post #21
hashkb wrote: post #11

Earlier quoted context omitted.

Can I take advantage of this on my mobile device or browser? Can I share with my team? It's not really apples to apples.

Yes. You can. [0] I run passff [1], to get Firefox to use it, and Android-Password-Store [2] on my phone. [0] https://www.passwordstore.org/#extensions [1] https://github.com/jvenant/passff#readme [2] https://github.com/zeapo/Android-Password-Store#readme

Theres also browserpass [0], it works great in firefox and chrome as well.

A great great plugin is pass-otp [1], using this I have migrated the storage of all OTP secrets from my phone to pass. And then I export it from pass to my phone. That way I still have my OTP secrets if I loose my phone and don't have to hassle with recovery of accounts just because of loosing the phone. For sure the OTP needs to be changed at that point but still worth it.

It's also worth to mention that browserpass [0] integrates pass-otp [1] so whenever I log in to a page (that has an OTP secret) using browserpass it shows a litle box in the top right corner with the current OTP code that I can copy-paste to the site.

[0]: https://github.com/browserpass/browserpass

[1]: https://github.com/tadfisher/pass-otp

Post reply on HN