11–20 of 522 posts
I would never have someone else manage my passwords for me. You have to trust the server. It could serve the user with malicious JS code or an app update at any time. You can self host it though.
More often than not these corporate open source projects include spyware features (Bitwarden included) that phone home without user consent.
They claim selfhosting is a goal, yet their published client will report on your activity to Microsoft without your consent.
Well that’s annoying. I guess the clock is ticking on Bitwarden becoming user hostile. I can’t see how they’ll be able to produce a return on that investment at their current price points. Having said that, I do think there is an opportunity for Bitwarden to expand into application secret management, and that could be a lucrative market with big enterprise customers if they get it right. The announcement seems to be…
I would never have someone else manage my passwords for me. You have to trust the server. It could serve the user with malicious JS code or an app update at any time. You can self host it though.
Likely though they will be stored and kept properly, and there won't be leaks. I only said 'unfortunately' because it hands dependence over to Google. Loss of access is the main concern.
In many ways it's a shame when a useful tool turns into a high growth startup. They're going to hire a bunch of developers who will need to justify their existence by adding features, they'll probably eventually either fail or get purchased and shut down. And then all the overly complex applications will start to rot. What's wrong with saying "this is a useful tool" and leaving it at that?
Well that’s annoying. I guess the clock is ticking on Bitwarden becoming user hostile. I can’t see how they’ll be able to produce a return on that investment at their current price points. Having said that, I do think there is an opportunity for Bitwarden to expand into application secret management, and that could be a lucrative market with big enterprise customers if they get it right. The announcement seems to be…
I expect to see a rapid push to enterprise with individual users left behind and a lot of broken stuff along the way :/
I would never have someone else manage my passwords for me. You have to trust the server. It could serve the user with malicious JS code or an app update at any time. You can self host it though.
I still use the Bitwarden extension in Firefox, which is a similar attack surface to what you describe, though probably a shade less vulnerable in practice. I’d like to replace it with something leaner and functionally superior (it’s pretty heavy, and has the major problem of mostly not working in Private Browsing windows, and some other timing/focus issues that I suspect stem from the same bad design), but I have too much other stuff I want to use.
I don’t serve the Bitwarden web interface on my server at all, but I could.
Bitwarden remains committed to
A fully featured free version, forever
An open source architecture
The ability to self-host
Advanced business features