Earlier quoted context omitted.
Can you please explain this more?
I cannot disclose the algorithm. What feature do you want explained?
How do you solve for password expiration and prohibited reuse?
Bitwarden: Free, open-source password manager
261–270 of 306 posts
Re: Bitwarden: Free, open-source password manager
#262Since nobody has mentioned: iOS 17 and macOS Sonoma brings family sharing to password managerm. Sonoma also brings support for using native passwordsl manager in Chrome using a chrome extension developed by Apple. For families who are hooked into Apple's ecosystem, this can provide a much better password management than third party tools.
I have been looking to move away from 1Password and did look into this. The thing that prevented me from doing so is that if someone got access to your AppleID (through phishing or social engineering), it allows them to essentially take control of your entire online presence. Right now, I try to keep the single point failures to a minimum (ie don't keep Apple ID in password manager). Is this a concern that's worth thinking about or am I just shifting the problem from one place to another?
Re: Bitwarden: Free, open-source password manager
#263Re: Bitwarden: Free, open-source password manager
#264Earlier quoted context omitted.
FYI - Your two primary alternatives are LastPass and 1Password. The former of which is melting down due to security flaws, and the latter has raised roughly $1B in VC money: https://techcrunch.com/2022/01/19/1password-series-c-funding... At a certain point, you just have to live your life. To accept that products you use might change in the future, and you might need to migrate to something else down the road. The al…
I've found ProtonPass to be useful. Depending on how you feel about the proton ecosystem. I don't know how much VC money they've taken though.
I use Proton for everything, but until they have a ProtonPass CLI, it is a non-starter for me. I want CLI access for my terminal email client.
Re: Bitwarden: Free, open-source password manager
#265Earlier quoted context omitted.
Not sure what you are using because my bitwarden does not have a secondary key.
What is the primary login method? Because I'm using SSO, and it still requires a master password.
A master password isn’t what we’re talking about though.
1Password last I used it, asked for a master, and a secret extra password. I still cannot explain why.
Granted my setup was for corporate but I am pretty sure it’s the same for everyone.
My best guess is that they are trying to cover for weak masters in the way that LastPass was enforcing but failing to update their PBKDF2 interations.
Which IMO is stupid and a failure to enforce best practices at the user’s first input.
Re: Bitwarden: Free, open-source password manager
#266I'm surprised no one's mentioned Padloc [1] yet. It's end-to-end encrypted, open source, easy to self host, and with a really UI + UX. I got all my family to use it and used it for a over a year, before eventually contributing actively to it. There's even a Tauri-based desktop app! Full disclosure: I have "contributing power" but do not make money from its sales or anything like it. [1]: https://padloc.app
First time I’m seeing this and the branding/design shouts “stay away from me, I’m a student project!” Not exactly the impression I’d like to see when using a password manager. And I’m a UI/UX designer in case you wonder…
Do you care to elaborate on why you feel this way? Specifics would be appreciated. I'm not getting the same signal from it at all.
Re: Bitwarden: Free, open-source password manager
#267Here, I also want to mention vaultwarden which is an open-source Rust implementation of the server: https://github.com/dani-garcia/vaultwarden
Just a reminder that the official bitwarden server is also FOSS (AGPL): https://github.com/bitwarden/server
Written in .NET!
What a disaster...
Re: Bitwarden: Free, open-source password manager
#268Here, I also want to mention vaultwarden which is an open-source Rust implementation of the server: https://github.com/dani-garcia/vaultwarden
Only thing missing from Vaultwarden is SSO/Oauth. There’s a PR for it that’s been open for years. I’ve lost hope that it’ll ever land.
This is the first feature they should have implemented.
Re: Bitwarden: Free, open-source password manager
#269I wanted to like Bitwarden, due to its “open source” nature. But 1Password is really miles ahead, and it's a little ironic, as 1Password 8 went through a major refactoring to a Node-enabled UI, which many people disliked, and it's still miles and miles ahead. I tried teaching my father to use Bitwarden for the sole reason that it seemed to be translated into my native tongue. In his use, Bitwarden turned out to be co…
Can you say more? In what ways is 1Password miles ahead? What are the big differentiators for you personally?
Re: Bitwarden: Free, open-source password manager
#270Earlier quoted context omitted.
Note that pass by design leaks both the websites you have set up and the metadata of the history of each record. This might suit your threat model, or it might not.
If I'm looking in your ~/.password-store directory and see entries named Finanace/, Travel/, Streaming/, Work/... you have bigger problems.
Could I ask why?