Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Get your passwords out of Bitwarden while you still can

osnews.com

Post reply on HN
Print view View original

101–110 of 203 posts

Re: Get your passwords out of Bitwarden while you still can

#101

Post by pavon »

Terr_ wrote: post #41

So I have an admission here: I keep seeing HN stuff about these networked password managers and I don't quite understand the appeal. Is it because everybody else is swapping between several different computers, and you need the synchronization? I just have everything in KeepassXC, and the ciphertext is subject to the same kind of backup regime I use for other files, [edit: and also additionally] a copy kept on a USB…

Syncing is a huge part, UX is another. I was using KeePass on my desktop for several years before I met my wife, and having her use it was a complete failure. She did not like the workflow. Having to open another another tool, login, search for the correct site, and copy/paste the password was too much friction. And that was when things worked.

Syncing was an utter disaster. Inevitably something would cause syncs to be delayed, and then there would be a conflict and one of our changes would be silently lost. We were constantly going to lookup a password we entered, and finding it was not there anymore, at which point I would have to dig through sync conflict backup files and manually reenter the passwords that were lost, or go through the password reset flow for the sites. It was a giant mess, and that was just with two desktops and a laptop. I was using btsync at the time but all the issues I encountered apply to any file based synchronization, like syncthing, nextcloud or dropbox. Performing whole database file synchronization is simply not the right approach for password safe.

I eventually switched over to self-hosted BitWarden with the browser plugin and it has been much smoother.

Re: Get your passwords out of Bitwarden while you still can

#102

Post by marcosdumay »

Terr_ wrote: post #41

So I have an admission here: I keep seeing HN stuff about these networked password managers and I don't quite understand the appeal. Is it because everybody else is swapping between several different computers, and you need the synchronization? I just have everything in KeepassXC, and the ciphertext is subject to the same kind of backup regime I use for other files, [edit: and also additionally] a copy kept on a USB…

I used to use syncthing to solve that problem, until the developer dropped the distribution because of the Google's anti-social behavior.

But the interface of every software on a phone is so atrocious that I have never actually seen any benefit from having a password manager there that I could copy stuff from. So now I just don't have it, and haven't seen any loss yet.

That said, I store way more low-value passwords on the Firefox manager (that is synchronized) than high-value ones on the offline manager.

Re: Get your passwords out of Bitwarden while you still can

#103

Post by AlexandrB »

9x39 wrote: post #77

Serious question - how come free is a requirement for a password manager? Everyone's gotta eat, including the maintainers of password managers. Tech has generous TC, lots of high-end laptops and phones worth thousands, AI & cloud spend, and yet the only acceptable price for secrets management is $0 it seems at times.

For me it's not that it has to be free, but that it can't be a subscription service or cloud-hosted-only. It's why I left 1Password. I don't like trusting my password management to the whims of mercurial business decisions. It's only a matter of time until private equity smells blood in the water with this product category and starts "extracting value" through acquisitions and arbitrary price increases.

Re: Get your passwords out of Bitwarden while you still can

#105

Post by parliament32 »

webstrand wrote: post #89
parliament32 wrote: post #83

Earlier quoted context omitted.

My KeePassXC database auto-syncs to my Nextcloud instance. Nextcloud client on PCs, Keepass2Android on my phone, and it's the same end result as Bitwarden but without the shenanigans.

Do you have a solution for auto-merging conflicting changes? Because I think that's the real difference, editing on a laptop and on a desktop before the sync can occur, can cause data-loss (for my potentially naive use of keepassxc anyway).

I've never seen this happen, because (as far as I can tell) all KeePassXC clients auto-save the file any time a change is made, and all the Nextcloud clients auto-sync as soon as the file changes. Keepass is also resilient to the underlying file changing while you have, say, the edit password dialog open.

If a conflict did happen though, newer versions of Nextcloud just keep both copies and alert you to resolve it. If I had to resolve this I'd probably try the built-in database merger first: https://keepassxc.org/docs/KeePassXC_UserGuide#_merging_data...

Re: Get your passwords out of Bitwarden while you still can

#106

Post by arikrahman »

scrollop wrote: post #55
tfarias wrote: post #31

I've been recommending Bitwarden for a few years now and have also been paying a yearly sub since 2022, as I always thought 10$ was a really good value. But with all this stuff coming out, I'm holding off on recommending it anymore; at least until everything calms down and the new value proposition is fully laid out. Like other folks have said, I don't think it's yet time to migrate. That being said, it doesn't hurt…

You should try hosting it yourself in docker. Absurdly easy to do if you get an llm to do it and it works very, very well. Hope they don't alter self hosting it.

You can get rid of the element of hope by using KeepassXC and syncthing. Bonus is you can use this FOSS stack completely offline.

Re: Get your passwords out of Bitwarden while you still can

#107

Post by hnarn »

9x39 wrote: post #77

Serious question - how come free is a requirement for a password manager? Everyone's gotta eat, including the maintainers of password managers. Tech has generous TC, lots of high-end laptops and phones worth thousands, AI & cloud spend, and yet the only acceptable price for secrets management is $0 it seems at times.

It’s about the backpedaling. No one says it has to be free, they said that. They just have to keep their promise.

Re: Get your passwords out of Bitwarden while you still can

#108

Post by parliament32 »

culi wrote: post #94
parliament32 wrote: post #87

Earlier quoted context omitted.

KeePassXC has always been the one true path.

What is the option for people who want access to their passwords on their phones and don't wanna set up a complex or fragile sync regime (I do use KeePassXC btw. I just think this is what GP's real question was)

Ultimately, you have to store the file somewhere and sync it to all the places you want it. The magic here is that it decouples the "password manager" and the "file syncer" so you can (and should) use whatever you're already using. Greenfield, Nextcloud is the cleanest if you want FOSS and self-hosting (and they have clients for basically every platform under the sun), otherwise pick your poison between google drive, dropbox, icloud, onedrive, etc.

Re: Get your passwords out of Bitwarden while you still can

#110

Post by ptrl600 »

eleventen wrote: post #7
tremarley wrote: post #4

Earlier quoted context omitted.

Never underestimate the lengths companies will go to, to enshittify their product to squeeze customers for money.

Name one major password manager that blocks or paywalls export.

Usually when this type of thing happens, all the major players decide to do it at the same time.
Post reply on HN