Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Free, open-source password manager

bitwarden.com

Post reply on HN
Print view View original

211–220 of 242 posts

Re: Bitwarden: Free, open-source password manager

#211

Post by jillesvangurp »

dmm wrote: post #203
jillesvangurp wrote: post #69

Earlier quoted context omitted.

That's because web developers are not great at sticking to conventions and standards for this stuff. Product owners and UX designers seem to ignore aligning their signup and signin UX with obvious requirements for enabling people to use a password manager. If they'd make this a hard requirement, it would happen. It's not that hard even; we did that for our login form. Works great with Bitwarden. And on mobile too. Bu…

> Splitting the email and password form across two screens. This is done because it's an easier way to support both local login and SSO(like oauth or saml). By taking the username first you can determine whether to ask them for a password or send them to a sso provider. It doesn't have to be implemented this way but it is seen as easier.

Yes, unfortunately a lot of implementations for this break password managers. It doesn't have to be that way and there are ways to fix it. But it complicates things a bit. And it's a pattern that actually gets copied a lot by products that definitely don't do any form of SSO.

Also, a typical opendid flow or SSO would not actually require an email field at all. So splitting the screens is kind of redundant in that case. E.g. a Github signin would be done with a button click and a few redirects.

Re: Bitwarden: Free, open-source password manager

#212

Post by yifanl »

phito wrote: post #132
shp0ngle wrote: post #127

I frankly thing password managers are the most stupid thing. We fake users inputing text to input boxes and spend crazy time figuring out how to do that and how to get around various sites trying to block that, so the site can still pretend it’s actual user inputting the password. Plus the manager needs to work around arbitrary password rules. Plus they usually don’t work at OS level; so you still need to remember th…

Password managers are the most stupid thing, really? What better alternative do you propose?

Generate two random 32 length strings. For the sake of this example, let them be 2quvs7jriTXQK8sFv4LzBZRtSN9hqp9q and qFTNX4f5sduaLYShWx96EyZw9ZRNLmqY.

Designate the first to "heads" and the second to "tails". Every time you're prompted to login with a password, flip a coin and enter that designated password. If it fails, then enter the second password.

For those interested in basic cryptography, feel free to point out the major and obvious flaw in this approach.

Re: Bitwarden: Free, open-source password manager

#214

Post by leokennis »

Twisell wrote: post #58
Milner08 wrote: post #25

Earlier quoted context omitted.

Really? Its less than the cost of a pint. Not exactly expensive considering the benefits. Sure it could be free, but its not expensive.

Depend on your platform. MacOS/iOS/iPadOS come with a more than decent integrated password manager for free. It almost never fail to identify password field and work both for web site and compatible applications. The paying part is when you want to sync key-chain between device and require an iCloud subscription which start at $0,99 and bundle other features. While I would never trust a "free service" (fremium backed…

To be fair, I trust 1Password to handle security a lot more than my own ability to protect a VPS running some password manager backend...

Re: Bitwarden: Free, open-source password manager

#215

Post by akoster »

Though it looks and sounds good, how would security be impacted by using the google chrome-based electron runtime to run the desktop client’s TypeScript and CLI runtime to run the server’s C# code? Wouldn’t this increase potential attack surface and probability of introducing vulnerabilities through more complexity (though this could be said for writing more of the stack oneself)? Im thinking about pass (https://www.passwordstore.org/) and KeePass 1.x (https://keepass.info) for comparison.

Re: Bitwarden: Free, open-source password manager

#217

Post by loceng »

vgalin wrote: post #37

> The most trusted open source password manager for business I expected a blog article with actual feedbacks from companies and data, but ended up on bitwarden.com main page. Baseless claims can be quite common when it comes to marketing, but I'm genuinely curious: which password manager is used in your workplace, if any? I've personally never seen in my (for now short) career anything else than Keepass.

Someone with good post draw should create a poll.

Re: Bitwarden: Free, open-source password manager

#218

Post by mkdirp »

neppo wrote: post #120
mkdirp wrote: post #48

Earlier quoted context omitted.

Bitwarden has quite a few of these sad quirks. It doesn't work very well in Firefox's private browsing. Only thing you can do is autofill by right clicking a text field and autofill from there, or the keyboard shortcut. But you cannot unlock it in private browsing. Stateless UI is annoying at best. There's a few times where this has slipped my mind, so I paste a generated password in a new item, and then go to copy t…

Firefox extension need permission to work in private browsing [1], after I gave permission it worked for me. [1] https://support.mozilla.org/en-US/kb/extensions-private-brow...

This isn't the problem. Re-read what I wrote.

Re: Bitwarden: Free, open-source password manager

#220

Post by mkdirp »

up6w6 wrote: post #160
mkdirp wrote: post #48

Earlier quoted context omitted.

Bitwarden has quite a few of these sad quirks. It doesn't work very well in Firefox's private browsing. Only thing you can do is autofill by right clicking a text field and autofill from there, or the keyboard shortcut. But you cannot unlock it in private browsing. Stateless UI is annoying at best. There's a few times where this has slipped my mind, so I paste a generated password in a new item, and then go to copy t…

They are trying to do some improvements to make it partially work in private tabs. If I understood correctly, there will still be some issues until they refactor the whole extension for Manifest V3 (deadline is Jan/2023). https://github.com/bitwarden/browser/pull/2121#issuecomment-...

Oh my, thanks for that link, I hadn't noticed. It's disappointed that addressing this[0] took 5 years and a whole lot of denying it's their fault, and that it is Mozilla's fault[1]! All it took was Chrome introducing a deadline...

[0] https://github.com/bitwarden/browser/pull/2121/commits/9d81b...

[1] https://github.com/bitwarden/browser/issues/136#issuecomment...

Post reply on HN