Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Free, open-source password manager

bitwarden.com

Post reply on HN
Print view View original

191–200 of 306 posts

Re: Bitwarden: Free, open-source password manager

#191

Post by StevePerkins »

jjice wrote: post #181

Huh, more negative than I expected. For some reason I had Bitwarden as an HN darling in my head. Not sure where I got that from. I pay for premium for $10 a year. Not sure what I actually take advantage of with that honestly but I just really like the product. That said, it's not based on a lot of competition searching. Am I missing out on some big benefits in other managers?

Really surprised by this as well.

So many comments are of the generic nature, " is miles ahead", without any specifics on what that's supposed to mean. My last few employers have used LastPass and 1Password, while I use Bitwarden for my personal stuff, and I prefer the latter by far.

The browser plugin is more reliable about recognizing when I'm entering or updating a password, and offering to store or update it. The iOS version has smoother integration with password autocomplete in other native apps. It MAY be that Bitwarden lags behind in "team" sharing features, I don't know. For personal use, that class of use cases is irrelevant to me.

As near as I can tell, there seems to be a lot of HN rage that "most" of Bitwarden is open source, but there are still some proprietary bits that keep it from 100%. I never understand this mentality, that software should fall from the sky like manna from heaven and not support a business. I also don't understand why these resentments never seem to stick to products like VS Code, that are the exact same way. Maybe Bitwarden should just try a sexier-looking dark mode UI?

Re: Bitwarden: Free, open-source password manager

#193

Post by hk1337 »

bad_user wrote: post #39

I wanted to like Bitwarden, due to its “open source” nature. But 1Password is really miles ahead, and it's a little ironic, as 1Password 8 went through a major refactoring to a Node-enabled UI, which many people disliked, and it's still miles and miles ahead. I tried teaching my father to use Bitwarden for the sole reason that it seemed to be translated into my native tongue. In his use, Bitwarden turned out to be co…

I thought it was okay. To get it running locally is slightly obfuscated from just running docker compose, IMO.

Re: Bitwarden: Free, open-source password manager

#194

Post by StevePerkins »

tiffanyh wrote: post #13

FYI - Bitwarden took $100M in VC money last year. At some point, the pressure to aggressively monetize will unfortunately happen. https://techcrunch.com/2022/09/06/open-source-password-manag...

FYI - Your two primary alternatives are LastPass and 1Password. The former of which is melting down due to security flaws, and the latter has raised roughly $1B in VC money:

https://techcrunch.com/2022/01/19/1password-series-c-funding...

At a certain point, you just have to live your life. To accept that products you use might change in the future, and you might need to migrate to something else down the road.

The alternative is just keep something like KeePass around on a thumb drive, and forgo all the cloud sync, and browser and native app autocomplete integration. But those things are really the main point to all these products. Without that, I would argue that you're better off with a pad of paper in your desk drawer.

Re: Bitwarden: Free, open-source password manager

#195

Post by Jnr »

bad_user wrote: post #39

I wanted to like Bitwarden, due to its “open source” nature. But 1Password is really miles ahead, and it's a little ironic, as 1Password 8 went through a major refactoring to a Node-enabled UI, which many people disliked, and it's still miles and miles ahead. I tried teaching my father to use Bitwarden for the sole reason that it seemed to be translated into my native tongue. In his use, Bitwarden turned out to be co…

Hosting at data centers is expensive, hosting at home is not expensive. You probably already pay for internet, why not use it.

My home server costs me about 3 euro per month in electricity (and it is quite beefy for a home server) and it runs many services, not just Vaultwarden. Add homeassistant for smart home, nextcloud for document cloud, jellyfin for media, immich for photo backups, etc. Maintenance using docker and compose is also trivial task.

On top of that, it runs in a private network and has limited exposure to the outside world though VPN in case you need to access it away from home.

Yes, hosting a single service is more expensive, but hosting a bunch is much much cheaper.

Re: Bitwarden: Free, open-source password manager

#196

Post by nyolfen »

neandrake wrote: post #135
haizhung wrote: post #118

Earlier quoted context omitted.

Does it have WiFi sync? Seems like all the big players are committed to removing that, and that’s like the one single thing I want from a password manager: don’t store all my passwords in the cloud.

Check out CodeBook, it’s not open source but it’s a 1-time fee for device type (windows, Mac, iPhone, android), up to five installs. I’ve purchased for phone, MacBook, and windows pc and been using for the past 5+ years and am satisfied with it. The product itself isn’t open source but the company which makes it does develop an open source module/extension of SQLite for encrypted database. All syncing is manually don…

wow, closed source, manual sync, and i get to pay for it?

Re: Bitwarden: Free, open-source password manager

#197

Post by shortcake27 »

UncleMeat wrote: post #174
shortcake27 wrote: post #61

Earlier quoted context omitted.

Storing OTPs in your password manager is like 1.5FA. It still provides protection against phishing, brute-forcing, socially engineered password resets, so it isn’t totally useless. But it doesn’t protect against your vault getting compromised. I keep super important 2FA codes (email, github etc) elsewhere, and for less important services, I store the OTP in my password manager.

OTPs don't protect against phishing. You still type the TOTP in a browser window that sends it off to the attacker. Phishing SDKs automatically handle proxying the password over and then proxying the TOTP over.

Depends how sophisticated the attack is. Plenty of attacks aren’t. I could have been clearer in my comment, but what I meant was “can protect” not “guaranteed protection”, I apologise if it was taken that way.

On the topic of phishing and OTPs, storing the OTP in your password manager could actually help with phishing (opposed to storing it in an authenticator), because it will only autofill on the correct domain. This can be the difference between compromising a password or the whole account.

Re: Bitwarden: Free, open-source password manager

#198

Post by darrmit »

Bitwarden is not perfect, but calling `pass` "easy" is comical - especially for those of us sharing passwords with far less technical family members - and 1Password has a very opinionated UI that seems to get more in the way than anything. I find Bitwarden to strike a good balance between security, price, and design.

That said, I do share in the concern about the funding and exec changes.

Re: Bitwarden: Free, open-source password manager

#199

Post by SV_BubbleTime »

bad_user wrote: post #39

I wanted to like Bitwarden, due to its “open source” nature. But 1Password is really miles ahead, and it's a little ironic, as 1Password 8 went through a major refactoring to a Node-enabled UI, which many people disliked, and it's still miles and miles ahead. I tried teaching my father to use Bitwarden for the sole reason that it seemed to be translated into my native tongue. In his use, Bitwarden turned out to be co…

1Password’s additional secret password to log in is an absolute non-starter for our corporation.

I could barely understand it myself let alone explain it to our lowest understanding employees.

Re: Bitwarden: Free, open-source password manager

#200

Post by e12e »

rmdes wrote: post #66
ploum wrote: post #28

Earlier quoted context omitted.

Wow, thanks for the info. This is indeed quite a huge sum of money for such a cheap service from which you can easily migrate. That’s a bit worrying.

should OSS users of Vaultwarden be worried?

Please note that bitwarden server is floss too - vaultwarden is just a simpler backend to self-host (and without a dependency on Microsoft SQL server):

https://github.com/bitwarden/server

https://github.com/dani-garcia/vaultwarden

Post reply on HN