Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Free, open-source password manager

bitwarden.com

Post reply on HN
Print view View original

61–70 of 306 posts

Re: Bitwarden: Free, open-source password manager

#61

Post by shortcake27 »

Try1275 wrote: post #7

I am a happy user and find it very convenient but how safe is it really to have all your jewels centralized in the cloud, including 2FA. It seems such a worthwhile target. On the other hand keeping everything in sync manually seems a hassle and in the end you just encrypt on your machine and the syncing goes through the cloud anyway, so where's the difference? I'd be happy to hear thoughts on this.

Storing OTPs in your password manager is like 1.5FA. It still provides protection against phishing, brute-forcing, socially engineered password resets, so it isn’t totally useless. But it doesn’t protect against your vault getting compromised.

I keep super important 2FA codes (email, github etc) elsewhere, and for less important services, I store the OTP in my password manager.

Re: Bitwarden: Free, open-source password manager

#62

Post by guerby »

Tmpod wrote: post #18
firtoz wrote: post #6

Does it have syncing 2fa support? That's what keeping me paying for 1Password. I know it's controversial, it's a risk I'm willing to take.

It does, in the premium plan ($10/year).

vaultwarden also has 2FA support.

I'm using it (FIDO2/webauthn)

Re: Bitwarden: Free, open-source password manager

#63

Post by BrunoBernardino »

I'm surprised no one's mentioned Padloc [1] yet. It's end-to-end encrypted, open source, easy to self host, and with a really UI + UX. I got all my family to use it and used it for a over a year, before eventually contributing actively to it.

There's even a Tauri-based desktop app!

Full disclosure: I have "contributing power" but do not make money from its sales or anything like it.

[1]: https://padloc.app

Re: Bitwarden: Free, open-source password manager

#64

Post by tuhriel »

hollander wrote: post #56
autophagian wrote: post #12

Earlier quoted context omitted.

For this I self-host vaultwarden ( https://github.com/dani-garcia/vaultwarden ), an implementation of the bitwarden server, on my raspberry pi at home (and back up the DB frequently). It works well enough for me, and doesn't have my stuff stored in a single company's cloud.

So what if the disk crashes? Do you keep backups? In the cloud?

There are different places to keep backups

My relevant data is synced regularly to my nas (running a raid-1) and I weekly back the whole thing up to an offsite disk at my parents house.

Can someone who really really want it, get to it? Sure, how big of a target am I against a cloud provider?

Re: Bitwarden: Free, open-source password manager

#65

Post by fryktelig »

proaralyst wrote: post #48
tkubacki wrote: post #27

Open source and easy to use https://www.passwordstore.org/

Note that pass by design leaks both the websites you have set up and the metadata of the history of each record. This might suit your threat model, or it might not.

Wouldn't the attacker need to breach your git server first before that was leaked?

Re: Bitwarden: Free, open-source password manager

#66

Post by rmdes »

ploum wrote: post #28
tiffanyh wrote: post #13

FYI - Bitwarden took $100M in VC money last year. At some point, the pressure to aggressively monetize will unfortunately happen. https://techcrunch.com/2022/09/06/open-source-password-manag...

Wow, thanks for the info. This is indeed quite a huge sum of money for such a cheap service from which you can easily migrate. That’s a bit worrying.

should OSS users of Vaultwarden be worried?

Re: Bitwarden: Free, open-source password manager

#67

Post by monlockandkey »

I don't agree with the self hosted Bitwarden philosophy. Having a "server" to manage passwords is overkill for most people. The best is to use an encrypted keepass file stored on your cloud storage (Google drive, Dropbox etc).

It is portable and easy to access from anywhere ( don't need to VPN to your local network). Not a fan of the self hosted server password management model. Doesn't make any sense unless managing multiple users.

Re: Bitwarden: Free, open-source password manager

#68

Post by monlockandkey »

FirmwareBurner wrote: post #26
tiffanyh wrote: post #13

FYI - Bitwarden took $100M in VC money last year. At some point, the pressure to aggressively monetize will unfortunately happen. https://techcrunch.com/2022/09/06/open-source-password-manag...

My take in life: whenever VC or PE investors take over, start moving away from that product and pronto .

Hopefully VC never ever touch Hackernews...

:)

Re: Bitwarden: Free, open-source password manager

#69

Post by unixhero »

monlockandkey wrote: post #68
FirmwareBurner wrote: post #26

Earlier quoted context omitted.

My take in life: whenever VC or PE investors take over, start moving away from that product and pronto .

Hopefully VC never ever touch Hackernews... :)

Oh sure yes they are indeed here.

Re: Bitwarden: Free, open-source password manager

#70

Post by caoilte »

b1476 wrote: post #16
nomercy400 wrote: post #2

I am a KeepassXC user, yet this sounds interesting. What does Bitwarden offer to make me want to switch?

For what it’s worth I was a longtime KeepassXC user. Switched to Bitwarden to have easier shared passwords between myself and partner/family however I’m now moving back to KeepassXC. I support Bitwarden fully however the app itself is just so badly designed. The UI is dreadful (both the website and desktop app) and I find it very frustrating to use. The whole layered concept of folders and inability to have tags is a…

Keepassxc is great and works well with keepass2android via file sharing.

I can imagine how the password sharing would be a problem tho.

Post reply on HN