What are the advantages and disadvantages of Bitwarden over KeePassXC?
Bitwarden – Open Source Password Manager
111–120 of 163 posts
Re: Bitwarden – Open Source Password Manager
#112If anyone wants an open source command line driven password manager that doesn't require signing up or hosting anything, I recommend checking out "Pass". It piggy backs off GPG encryption.
https://www.passwordstore.org/
I use it to manage over 300 passwords and other sensitive blobs of text (it lets you save arbitrary text snippets) and also has some nifty quality of life features like auto-copying a password to your clipboard for 30 seconds when you want to access a specific password.
Re: Bitwarden – Open Source Password Manager
#113Earlier quoted context omitted.
I get that Electron is undesirable, but what do you mean by unsecure? Also, can you list some alternatives if you don't want them building a desktop app in Electron?
Malware can sweep through the memory to find passwords by reading memory directly from another process' address space.
This is a risk in desktop software written in other languages and with other gui frameworks as well, no?
Re: Bitwarden – Open Source Password Manager
#114https://github.com/bitwarden/core/blob/master/README.md SQL Server 2017, really? Interesting choice. Open source but we have to pay licenses for the database if we want to self host. I wonder what was wrong with PostgreSQL or MySQL even if they're using .NET Core as a language. Edit: there is an issue for that https://github.com/bitwarden/core/issues/10
Pretty sure they were in the BizSpark program from Microsoft so that probably influenced alot of their technology choices
They were, check this discussion on HN two years ago https://news.ycombinator.com/item?id=12676979
Re: Bitwarden – Open Source Password Manager
#115If anyone wants an open source command line driven password manager that doesn't require signing up or hosting anything, I recommend checking out "Pass". It piggy backs off GPG encryption. https://www.passwordstore.org/ I use it to manage over 300 passwords and other sensitive blobs of text (it lets you save arbitrary text snippets) and also has some nifty quality of life features like auto-copying a password to your…
I like and use pass regulary, but it has some inconveniences.
- It doesn't encrypt the paths to the passwords
- It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password
- It doesn't work with (Update: X.509) smartcards/gpgsm
- It's written in bash. That has pros and cons...
Re: Bitwarden – Open Source Password Manager
#116Earlier quoted context omitted.
Ah shit, its a . NET program :( It all sounded really good until this point. I was even going to say you could add support for postgres, but I don't know a lot of open source devs who are using. NET.
Keepass2 is also Open-Source and .Net because as far as I know .Net offers some extra security on Windows like locking the desktop while entering the master password.
Can you please give me a link about locking desktop while entering a master password in KeePass? I want to know more about it.
Re: Bitwarden – Open Source Password Manager
#117If anyone wants an open source command line driven password manager that doesn't require signing up or hosting anything, I recommend checking out "Pass". It piggy backs off GPG encryption. https://www.passwordstore.org/ I use it to manage over 300 passwords and other sensitive blobs of text (it lets you save arbitrary text snippets) and also has some nifty quality of life features like auto-copying a password to your…
I like and use pass regulary, but it has some inconveniences. - It doesn't encrypt the paths to the passwords - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password - It doesn't work with (Update: X.509) smartcards/gpgsm - It's written in bash. That has pros and cons...
> - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password
only the first line of an encrypted file is considered to be the password. So you can just but your username or any other account-related information on the following lines.
> - It doesn't encrypt the paths to the passwords
To elaborate: One of the problems with this approach is that it may leak websites where you have accounts to people who gain access to your pass repo/directory even without gaining control of your gpg key.
> - It doesn't work with smartcards/gpgsm
What do you mean by that? I use pass with my yubikey as a gpg "smartcard"?
Re: Bitwarden – Open Source Password Manager
#118Earlier quoted context omitted.
Is storing the 2FA codes alongside your password a wise idea?
Yes, if the attack vector you're trying to close is a compromised keyboard/network/terminal and not a stolen-while-unlocked device. "Catching" one 2FA code doesn't let you compromise someone's account. Losing (or having compromised) the hardware running your password manager while that password manager is unlocked is a totally different thing from logging into a web site once from a library computer.
> Yes, if the attack vector you're trying to close is a compromised keyboard/network/terminal and not a stolen-while-unlocked device.
however, not having the TOTP key in your password manager would also protect against malware on your machine running the password manager from gaining access to your account.
Re: Bitwarden – Open Source Password Manager
#119Earlier quoted context omitted.
No, it’s worse.
Very thorough argument.
Matches the question, but should be obvious why.
I do not have the inclination or resources to secure and keep my server up to date, unless we are talking about a periodic "apt upgrade" that I could configure to run automatically, but no more than that. And at the very least I know how to reasonably secure a Linux server, at least initially.
If running your own server gives you peace of mind in terms of security, then read more about how security works and the threat model you'll face. Just to give an obvious example ... running your own Wordpress is one of the worst thing you can do on your own server, putting your whole server at risk, not just your website.
Re: Bitwarden – Open Source Password Manager
#120Earlier quoted context omitted.
> Open source but we have to pay licenses for the database if we want to self host. As Bitwarden states in the core readme ( https://github.com/bitwarden/core#requirements ) "These dependencies are free to use." And if you lookup the licensing on MSFTs website ( https://www.microsoft.com/en-us/sql-server/sql-server-2017-p... ) you can see that the SQL Server Express version is free. Note: No, I'm not an MSFT employee…
I'm not in the Microsoft stack so I have no idea how much SQL Server and SQL Server Express are compatible. I only know they exist. The README requires SQL Server so I might be excused thinking that it would work only with that software. Nice to know that it does work on the free version too. I googled and looked on MS site and didn't find out if SQL Server Express exists for Linux too, but I'm on my phone right now.…
Yes, SQL Server Express is available for Linux.