Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Avoid at all costs (outage issue)

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 137 posts

Re: Bitwarden: Avoid at all costs (outage issue)

#101

Post by cycomanic »

Reflex0184 wrote: post #2

If you need "seven nines", your best bet might be to host it yourself. Probably not going to find it anywhere for $10/yr

What do you mean apart from the local solutions like pass or keepass, hosting yourself for under $10/year is absolutely trivial. I mean just spin up the smallest free instance on oracle free cloud and run vault warden there. If you want additional data safety spin up another instance and synchronize your database or synchronize to a free Dropbox drive.

If you don't want to rely on a free cloud product go to lowendtalk and find an offer for a minimal VPS, which can regularly found for around $10/year.

Re: Bitwarden: Avoid at all costs (outage issue)

#102

Post by remuskaos »

doodlesdev wrote: post #29
cabbagesauce wrote: post #19

Earlier quoted context omitted.

...not yet. Just as Authy was a nice TOTP software. Until they introduced their vendor lock-in TOTP format.

Authy was never open source, nor self hostable, nor did it allow you to export TOTP tokens. You also don't have to use their own TOTP format if you don't want to, in fact I've yet to see any website that actually uses it. The equivalent to Bitwarden when it comes to managing 2FA would be something like Aegis, which is open source and has feature parity with Authy. [0]: https://getaegis.app/

If the parent means the 7 digit style when referring to authys own topt format: Cloudflare and humble bundle use those. Thankfully Aegis also supports these.

Re: Bitwarden: Avoid at all costs (outage issue)

#103

Post by elashri »

yogenpro wrote: post #13

I've been using Bitwarden's clients (browser extension, mobile apps, desktop apps) with a self-hosted vaultwarden [1] server. It's marginally free if you are already self-hosting other stuff. I'm hosting it on a raspberry pi 4b at home and exposing it to public Internet through Cloudflare zero trust (also free). Had no problems so far. [1] https://github.com/dani-garcia/vaultwarden , note that it's different from Bit…

Iam curious how you made the clients connect to the server behind CF zero trust. have you white-listrd a path or so for them?

Re: Bitwarden: Avoid at all costs (outage issue)

#104

Post by mort96 »

Georgelemental wrote: post #9

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

How do people use KeePassXC? Do people not need access to their passwords when they're on their phones? And how do people choose between all the KeePass derivatives?

Re: Bitwarden: Avoid at all costs (outage issue)

#106

Post by bpye »

cycomanic wrote: post #97
bpye wrote: post #82

Earlier quoted context omitted.

I switched from KeePassXC to Bitwarden (self hosted with Vaultwarden) a couple years ago. The experience is considerably better, the BW iOS app is great, and the Firefox extension also works reasonable well. I could never get integration in either case to work as well with KeePassXC. I'm confident if BW pull any real nonsense, there will be a fork of the client, and there's no reason for Vaultwarden to go away...

> I switched from KeePassXC to Bitwarden (self hosted with Vaultwarden) a couple years ago. The experience is considerably better, the BW iOS app is great, and the Firefox extension also works reasonable well. I could never get integration in either case to work as well with KeePassXC. I'm confident if BW pull any real nonsense, there will be a fork of the client, and there's no reason for Vaultwarden to go away... W…

I found it kind of a pain to keep the Firefox extension connected. Additionally, I never found a solution for sync I was happy with - I had settled on OneDrive and there is an open source OneDrive sync client for Linux, but I had a couple instances where I ended up with conflicts and having to copy new or modified entries over manually. I’m not sure that any sync client is great across all of Windows, macOS, Linux and iOS - but I use them all frequently.

I can’t really comment on secrets, I use a YubiKey for SSH and GPG for signing Git commits so I’ve never needed to look into it.

Re: Bitwarden: Avoid at all costs (outage issue)

#107

Post by DavideNL »

mort96 wrote: post #104
Georgelemental wrote: post #9

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

How do people use KeePassXC? Do people not need access to their passwords when they're on their phones? And how do people choose between all the KeePass derivatives?

> on their phones?

Strongbox for iPhone/iPad: https://strongboxsafe.com/

There are plenty Android Keepass apps too, i don't have any experience with these though.

>And how do people choose

FWIW, KeePassXC is the best (most widely adopted) one for Desktop.

Re: Bitwarden: Avoid at all costs (outage issue)

#108

Post by KronisLV »

orangepurple wrote: post #39
doodlesdev wrote: post #11

Earlier quoted context omitted.

Another options is pass [0], which uses GPG to encrypt your stuff. Everything happens through the CLI but there are also GUI frontends for it. There's also gopass [1] which is very similar and compatible but does some extra stuff such as versioning with git. Similarly to this API compatibility there's KeePassDX [2] for mobile phones which is compatible with the KeePass database format. There's also KeePass [3] which…

Not a solution. My passwords database needs to work seamlessly on my laptops and phones so I only use KeepassXC and KeepassDX synced with Syncthing. Free and super effective. I don't have to do any manual work for everything to be in sync always.

Seconding Keepass and many of the compatible software as excellent choices!

Use whatever you want for sharing your database across devices, like Syncthing or Nextcloud (or even USB thumb drives), as long as you have a strong password for it (or other means of unlocking it) and it should alleviate many of the availability related complaints about file based secret management.

It even allows storing files (like SSH keys) and on some platforms has the possibility of typing your credentials for you so they don't end up in the clipboard, even though when you use the clipboard functionality they get cleared out of it after a little bit.

Re: Bitwarden: Avoid at all costs (outage issue)

#109

Post by OJFord »

throw149102 wrote: post #37
throw149102 wrote: post #36

Lots of people are mentioning that you can host these types of things yourself, I want to say that that is not a solution at all. The entire point of these hosted password services is that they are a turnkey solution - I could give them to my mom, who knows nothing about technology, and trust that they work. I like using a turnkey solution myself even though I could self-host because I don't want to spend brain cycle…

Also re: the comparisons to AWS or Google Cloud - it's still totally different. This is more like your car being unable to start because it can't connect to the cloud. I don't expect that driving my car needs internet access, and I wouldn't expect Bitwarden needs internet access to serve me my passwords that have already been synced.

You have to log in to the extension to unlock passwords every so often though right, more than once per browser session? Presumably that's server-authenticated, and what broke here.

Re: Bitwarden: Avoid at all costs (outage issue)

#110

Post by thiht »

presto8 wrote: post #63
Canada wrote: post #20

No matter what password you use, I highly recommend regularly exporting a plaintext copy of it to somewhere safe like an encrypted volume on one or more of your devices. Just do it once a month - mount the volume, export the database in plaintext directly to the volume, then unmount it. If your password manager locks you out because of a bad software update, service outage, or you hold the wrong passport and got sanc…

This is great advice. The problem is that it is hard to have the discipline to do this month after month.

It doesn’t have to be every month. Just do it once for a start, you’ll be happier with an old backup than no backup. Then, you can just set a recurring reminder every n months on a Saturday or Sunday and do it at that time.
Post reply on HN