Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

11–20 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#11

Post by arianvanp »

xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

it's just WebAuthn with an easier to understand name.

However passkeys depends on a yet to be published standard for QR codes + bluetooth + websockets for doing WebAuthn from a second device. But that is planned to be published soon.

Re: Bitwarden Acquires Passwordless.dev

#13

Post by gagabity »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

Re: Bitwarden Acquires Passwordless.dev

#15

Post by tiffanyh »

allochthon wrote: post #6
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

I had a similar reaction. Acquisitions can be a signal that there's a go-to-market strategy being pursued.

Given that Bitwarden, Inc. is a for-profit company, isn't it expected they would have a GTM strategy.

Re: Bitwarden Acquires Passwordless.dev

#16

Post by Liquidor »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

I'm of the opposite opinion in this case.

If someone creates new tech and it fits with Bitwarden then I'm more than happy to see what they can do together.

Re: Bitwarden Acquires Passwordless.dev

#17

Post by jlundberg »

jlundberg wrote: post #2

And here is a link to the web site of this startup: https://www.passwordless.dev/ Anders Åberg (@andersaberg) who is the founder behind this is a really enthusiastic and inspiring coder. I've always enjoyed his mashup hackathon ideas and meetup presentations. :-)

For those curious, here is another fun project Anders has built in which he mix ambient music with live radio broadcasts from airports :)

https://listentothe.cloud/

Re: Bitwarden Acquires Passwordless.dev

#18

Post by paulryanrogers »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

BitWarden is open source on both ends. So worst case one can self host then fork clients. (Server has already been reimplemented independently.)

Re: Bitwarden Acquires Passwordless.dev

#19

Post by rvz »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

I'd like to remind you that Bitwarden is becoming completely VC backed with the way it is going [0] and there is always a possibility that it can be acquired to give investors a return. The same happened with Keybase as soon as they took VC cash.

It is now growth at all costs until an eventual acquisition of Bitwarden. So I won't be surprised to see price increases on some plans soon.

[0] https://bitwarden.com/blog/accelerating-value-for-bitwarden-...

Re: Bitwarden Acquires Passwordless.dev

#20

Post by 0xCMP »

xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

Passkeys is the "normal" name for a FIDO2/WebAuthn credential that basically lives within a phone or password manager. It does add a few things. Namely the ability to store many passkeys per device per app/site, the ability to sync those passkeys (e.g. via iCloud or similar), and the ability to use QR codes and Bluetooth to do a local-only authentication on a device which doesn't have the passkey (which is what often requires some proprietary implementation).

[Edit]: An important feature of "Passkeys" is that browsers and operating systems have a special API that allows an app to pre-start a sign in with a known user/email/etc. which if there is a passkey for that user it'll automatically start the FaceID or similar confirmation process. Which Passkeys are checked is controlled by the OS/Password Manager which checks which website is asking and what username it's checking. This is just to make it so it seamlessly logs you in. It does a fall-back to just asking what your user is which is the initial workflow.

This[0] is a good podcast to listen to with Adam Langley from Google about how Chrome supports Passkeys and why they're a good thing. It includes the details of how/where/why there are some proprietary bits needed to implement "Passkeys".

[0]: https://securitycryptographywhatever.buzzsprout.com/1822302/...

FIDO Alliance Press Release https://fidoalliance.org/apple-google-and-microsoft-commit-t...

Chromium Blog on Passkey support (Dec 8, 22) https://blog.chromium.org/2022/12/introducing-passkeys-in-ch...

Post reply on HN