Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Avoid at all costs (outage issue)

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 137 posts

Re: Bitwarden: Avoid at all costs (outage issue)

#11

Post by doodlesdev »

Georgelemental wrote: post #9

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

Another options is pass [0], which uses GPG to encrypt your stuff. Everything happens through the CLI but there are also GUI frontends for it. There's also gopass [1] which is very similar and compatible but does some extra stuff such as versioning with git.

Similarly to this API compatibility there's KeePassDX [2] for mobile phones which is compatible with the KeePass database format. There's also KeePass [3] which is the original built with .NET.

I personally use Bitwarden though because maintaining sync of databases on mobile phones is painful. Also keeping backups up to date is hard and time consuming, I do export my encrypted database once in a while though.

[0]: https://www.passwordstore.org/

[1]: https://www.gopass.pw/

[2]: https://www.keepassdx.com/

[3]: https://keepass.info/

Re: Bitwarden: Avoid at all costs (outage issue)

#12

Post by mistrial9 »

cabbagesauce wrote: post #6

So, as expected this is the response from the BW people. No one got hurt, no one to be blamed. Grab a beer, turn on your Netflix and be happy. Hello, Thank you for contacting Bitwarden. If you are receiving this message, you have contacted us about errors accessing your Bitwarden account. We would like to first apologize for any inconvenience. Access should no longer be impeded when authenticating. In our mission to…

In our mission to continually strengthen services and protect our brand we have employed many protections for our remote monitoring, control and IP...

what do people expect? all the wrong management are attracted to security products for exactly the reasons you suspected all along.. Lock-in is profits!

Re: Bitwarden: Avoid at all costs (outage issue)

#13

Post by yogenpro »

I've been using Bitwarden's clients (browser extension, mobile apps, desktop apps) with a self-hosted vaultwarden [1] server. It's marginally free if you are already self-hosting other stuff. I'm hosting it on a raspberry pi 4b at home and exposing it to public Internet through Cloudflare zero trust (also free). Had no problems so far.

[1] https://github.com/dani-garcia/vaultwarden, note that it's different from Bitwarden's official server (https://bitwarden.com/help/install-on-premise-linux/), uses less CPU/memory, and enables premium features like TOTP for free.

Re: Bitwarden: Avoid at all costs (outage issue)

#15

Post by doodlesdev »

mistrial9 wrote: post #12
cabbagesauce wrote: post #6

So, as expected this is the response from the BW people. No one got hurt, no one to be blamed. Grab a beer, turn on your Netflix and be happy. Hello, Thank you for contacting Bitwarden. If you are receiving this message, you have contacted us about errors accessing your Bitwarden account. We would like to first apologize for any inconvenience. Access should no longer be impeded when authenticating. In our mission to…

In our mission to continually strengthen services and protect our brand we have employed many protections for our remote monitoring, control and IP... what do people expect? all the wrong management are attracted to security products for exactly the reasons you suspected all along.. Lock-in is profits!

There is no lock-in to Bitwarden, stop spreading FUD. I'm not really sure how long this is going to be like this with the VC money, but right now:

- Everything is open source - You get to self host - You get to export your database at any time - You don't even need to pay to use it if you don't want to

Are local password managers objectively more secure and reliable? Yes. Does that mean that Bitwarden is just an awful product by a money seething corporation that wants to lock you into their product and dime you till your last cent? Not so sure about that.

Re: Bitwarden: Avoid at all costs (outage issue)

#16

Post by gremlinsinc »

I think maybe a good alternative type solution would be instead of a 'hosted' thing, I'd just like something like Bitwarden but your data gets pushed to devices it needs to be on, so it's always in a local database, and maybe you back it up to drive/dropbox easily, but the server just tracks when something changes/needs pushed and basically handles syncing stuff, other than that it doesn't keep any password data encrypted or otherwise, it's just a bridge.

Re: Bitwarden: Avoid at all costs (outage issue)

#18

Post by max-m »

doodlesdev wrote: post #11
Georgelemental wrote: post #9

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

Another options is pass [0], which uses GPG to encrypt your stuff. Everything happens through the CLI but there are also GUI frontends for it. There's also gopass [1] which is very similar and compatible but does some extra stuff such as versioning with git. Similarly to this API compatibility there's KeePassDX [2] for mobile phones which is compatible with the KeePass database format. There's also KeePass [3] which…

Personally I use the official KeePass 2 executable via Mono on my desktop. I would have given KeePassXC a chance but it lacks the trigger system or a simpler alternative. I use the trigger system to sync my local database with a copy on my server via the help of a shell script (because I couldn't get the SFTP / scp plugins to work properly). The trigger runs when the local database is being saved. As a first step it disables itself, as a last step it enables itself again. As a second step the trigger calls my script which downloads the database from my server. Then it runs the sync action against the freshly downloaded database and afterwards the trigger calls my script again and instructs it to upload the database to my server. I suppose this might be problematic if multiple devices try to change the remote file at the same time but that's nothing I have to worry about and other solutions like using Dropbox or other cloud storage solutions would run into some sort of problem as well (but at least you might be given the choice of which version to keep).

On my Android phone I use Keepass2Android and it's built-in SFTP support to open the remote database (and also keep a local offline-copy). When saving it seems to synchronize with the remote file first before uploading the file, so even if I change entries on both devices the copy on my server shouldn't lose any entries. But I haven't really tried to break it yet.

Re: Bitwarden: Avoid at all costs (outage issue)

#19

Post by cabbagesauce »

doodlesdev wrote: post #15
mistrial9 wrote: post #12

Earlier quoted context omitted.

In our mission to continually strengthen services and protect our brand we have employed many protections for our remote monitoring, control and IP... what do people expect? all the wrong management are attracted to security products for exactly the reasons you suspected all along.. Lock-in is profits!

There is no lock-in to Bitwarden, stop spreading FUD. I'm not really sure how long this is going to be like this with the VC money, but right now: - Everything is open source - You get to self host - You get to export your database at any time - You don't even need to pay to use it if you don't want to Are local password managers objectively more secure and reliable? Yes. Does that mean that Bitwarden is just an awfu…

...not yet. Just as Authy was a nice TOTP software. Until they introduced their vendor lock-in TOTP format.

Re: Bitwarden: Avoid at all costs (outage issue)

#20

Post by Canada »

No matter what password you use, I highly recommend regularly exporting a plaintext copy of it to somewhere safe like an encrypted volume on one or more of your devices.

Just do it once a month - mount the volume, export the database in plaintext directly to the volume, then unmount it.

If your password manager locks you out because of a bad software update, service outage, or you hold the wrong passport and got sanctioned, or whatever, at least you will still be able to access the vast majority of your credentials. Special password databases are nice and convenient, but plaintext is usable forever.

Post reply on HN