Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The quiet renovation at Bitwarden

blog.ppb1701.com

Post reply on HN
Print view View original

171–180 of 333 posts

Re: The quiet renovation at Bitwarden

#171

Post by mhitza »

dpark wrote: post #25
deanc wrote: post #8

I don't see the problem here. It's a great product and if they want to make money then I don't mind. If it's too expensive, and they hike the price to something ridiculous then I'll vote with my wallet.

I’m fine with paying a bit more. I honestly don’t think I even use any of the premium features. I started paying because their founder answered some question I sent years ago and I figured that kinds of support deserved my support. I could still be on the free tier if cost were a concern. With that said, I do find the direction here concerning. Quietly rewriting values, removing promise of free tier, hiking prices wi…

I'm in the same boat, became a premium member to support Bitwarden and use the built-in authenticator. The subscription price is now a negative proposition, alongside the silent rollout and the other red flags raised in the post. I'll probably move to self-hosted, since I have spare compute on my VPS.

Re: The quiet renovation at Bitwarden

#172

Post by xienze »

duckmysick wrote: post #103
giancarlostoro wrote: post #92

Earlier quoted context omitted.

Not my project but Vaultwarden is an open source (in Rust) alternative backend for Bitwarden. I believe its been around a while, and is still maintained. https://github.com/dani-garcia/vaultwarden

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

> how do you harden it?

By not exposing it to the wider internet. When I use a client (iPhone, browser, etc.) while on the home network, it syncs. While off the network, the last synced data is still there. That's been good enough for me.

Re: The quiet renovation at Bitwarden

#173

Post by Barrin92 »

0x262d wrote: post #67
welder wrote: post #27

I don't care about raising prices, I'm worried about the new CEO having a PE mindset. That means Bitwarden will now focus on extracting value while the product stagnates and degrades in quality. Time to jump ship before their security and quality goes down the drain.

I'm getting really tired of the enshittification cycle. Learning about android verification and captcha changes recently has been another big frustration point. I moved to android as a more open alternative to apple just a few years ago, and to bitwarden from lastpass around the same time. I would like to just have these infrastructural services work well and quietly without thinking about them for many years. Do I r…

>Do I really have to put up with this happening faster and faster for the rest of capitalism? (I think so)

no, if you relax the qualifier "without thinking" slightly and are okay with thinking for a few hours. There's so many off-the-shelf open source solutions now to just throw on a 5 bucks VPS, it costs you less time and money than switching or the premium plan of most of these individual services.

Re: The quiet renovation at Bitwarden

#174

Post by xienze »

jnovek wrote: post #156
bglusman wrote: post #150

Earlier quoted context omitted.

It is really easy to self-host, and do so securely...

I’m not buying hosting from a password manager, I’m buying security. I don’t have complete confidence that I can secure a self-hosted password manager and it’s not an area where I want to take risks.

It's very simple, just don't make it accessible outside your home network. Clients sync when the server is accessible and use last synced data otherwise.

Re: The quiet renovation at Bitwarden

#175

Post by dolmen »

armchairhacker wrote: post #104
gchamonlive wrote: post #94

Earlier quoted context omitted.

Yes, but vaultwarden isn't something you can casually run by yourself without some careful thinking. You are hosting secrets whose longevity is important, so if deploying yourself, take good care of backups and do regular drills, so you validate that the backups work, that they aren't corrupted and that you keep a copy off-site.

Is there anything stopping a commercial Vaultwarden host?

That already somewhat exists.

Reimplementing the server side is the easy part.

But a commercial offer will need rebranding the client, and maintaining forks is much more involved. As long as Bit warden publishes the sources ...

Re: The quiet renovation at Bitwarden

#177

Post by zzleeper »

jnovek wrote: post #137
zeroonetwothree wrote: post #109

Earlier quoted context omitted.

Bitwarden hasn’t “enshittified” anything. It’s all entirely speculative

I don’t wait for companies to enshittify anymore. When they start making decisions that look like they’re heading in that direction, I start looking for alternatives.

Same. Whenever I see a PE acquisition, I immediately shift my purchases (eg namecheap last year)

Re: The quiet renovation at Bitwarden

#178

Post by dolmen »

jerf wrote: post #87
antran22 wrote: post #58

When I first learnt about Bitwarden about 3 years ago, I started hosting Vaultwarden right away. Right now I have one instance for myself and another for my friend's company. Everything runs as smooth as butter. If you can self-host something, do self-host a Vaultwarden instance. If you are (like me) somewhat paranoid about the fact that Vaultwarden hasn't got a proper security audit on its codebase, just run it behi…

I'm running Vaultwarden because while on the one hand I'd like to just pay a company to make my password problem go away, I don't know who I can actually trust to not try to take advantage of the fact they have all the keys to all my kingdoms at some point. I see some people complaining about "Private Equity", with justification, and before that it was the "Harvard MBA" mindset, where businesses are encouraged to thi…

As long as you continue to use (and upgrade) the Biwarden client apps, you should consider that BW could have the keys of your garden: they have control of decryption and encryption code, so that code could leak the key, whatever the server.

Re: The quiet renovation at Bitwarden

#179

Post by moepstar »

baggachipz wrote: post #166

Say what you will, but the Apple ecosystem's Passwords app and integration works great. It locks me into their services (iCloud), but I don't see them ever charging for it or sunsetting it. (watch me eat my words in the near future)

Password App surely is a good alternative, however i don’t think there are clients for Linux or Windows? …and that is where Bit/Vaultwarden comes into play.

Re: The quiet renovation at Bitwarden

#180

Post by Goofy_Coyote »

oarsinsync wrote: post #81
RyJones wrote: post #51

Earlier quoted context omitted.

Apple's passwords app. It's what I use almost everywhere. I use 1password for work but I'd prefer not to mix work and personal life.

1Password for Business accounts all get an additional 1Password for Families license (5 seats), so you can absolutely keep your work and personal life separate.

What happens when you leave that business account? (e.g. change jobs, leave the company, get acquired and consolidate etc)
Post reply on HN