Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?
Bitwarden Acquires Passwordless.dev
101–110 of 399 posts
Re: Bitwarden Acquires Passwordless.dev
#102Your passwords shouldn't leave your device. Chrome's password manager is pushing it. Everything else should be considered malware. I don't understand how such a 'techy' crowd here on HN can be so belligerent with this security vs convenience trade off. KeePass locally, gmail yourself an encrypted backup. That's it. FFS.
Keeping your passwords on your device (and also in Gmail?) might work for you, but a password store that I can't conveniently access from both my computer and phone isn't useful to me, and I suspect, many others.
Re: Bitwarden Acquires Passwordless.dev
#103Earlier quoted context omitted.
They did? Oh JFC I just switched from 1Password to avoid using a VC backed service. At least there's always Vaultwarden, now all I need is a service I can pay to host an instance for me. ...and to not take VC funding. https://github.com/dani-garcia/vaultwarden Though I fear it’s only a matter of time before the VC gods demand the client apps remove compatibility and they have to be forked too.
I switched from 1Password to Bitwarden, imported my vault, and then realized that their client doesn’t even support drag ‘n drop. I’ve been wanting to switch from 1Password to Bitwarden for years, but each year I try it I’m just flummoxed by how atrociously behind the UX / UI still is. Unless you (or whoever you’re getting to switch) are an absolute open source absolutist: do yourself a favor and go for 1Password.
Bitwarden is the first password manager I ever used. Where would it use drag and drop and for what? I wish it would be better controllable vie keyboard-only. That is, when you use the Firefox add on and tab out of the Bitwarden popup and tab back in again it remembers the focus on e.g. the copy password button, you just have to hit space again and tab back to the terminal window where you need to use the password. But Brave doesn't remember the focus so annoyingly I have to grab the mouse.
Re: Bitwarden Acquires Passwordless.dev
#104Anyone know how Bitwarden fits into the "passwordless" equation here? I tried to log in to Dogwarden (shown in the video demo on passwordless.dev), but the Bitwarden extension/app doesn't seem to do anything during sign-up.
Also wondering if anyone knows why this device [1] doesn't work during the "passwordless" sign-up/sign-in process on dogwarden1.passwordless.dev. Am I going to have to buy yet another hardware key if I want passwordless logins?
Re: Bitwarden Acquires Passwordless.dev
#105Earlier quoted context omitted.
This is true, but LastPass proved that by the time the worst case occurs it's already too late. A security breach means, at minimum, redoing all your passwords, and these sites are a very compelling target. OTOH I wouldn't want to self-host because I know I'm not going to spend the same amount of time and effort a full security staff would, even if my self-hosted box would make a much less attractive target. It's qui…
You have security options self hosting that a big host does not. Want to just encrypt everything on a node with no network access? Sure. That doesn't work for a "real" host but that is fine if you mostly use your phone and need to just occasionally sync your passwords back at home. You don't need the things that make hosting hard. You can have a few hours of downtime. You password vault is gigabytes, not hundreds of…
Does bitwarden work if server is offline? I know the client works without internet connection but server outage had an issue earlier last year https://news.ycombinator.com/item?id=32782386
Re: Bitwarden Acquires Passwordless.dev
#106Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?
I wonder how iCloud shutdown would affect this route, but: your Passkeys are synced to your devices locally, and the whole "scan QR code on another device with your phone to authenticate" flow is fully local, utilizing key authentication over BLE.
Theoretically, your Passkeys should still be on your iPhone/iPad/Mac/iThing, and QR authentication will work. (And then you provision another key on another device, since Passkeys' intention is like SSH keys, allowing multiple on a single account)
Re: Bitwarden Acquires Passwordless.dev
#107I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...
Bitwarden is built as a zero knowledge platform and they can't access the contents of your Vault.
Re: Bitwarden Acquires Passwordless.dev
#108I own passwordless.app. I wonder if they will want to buy it from me now.
[dead]
Re: Bitwarden Acquires Passwordless.dev
#109One can easily self host a bitwarden server on digitalocean. https://bitwarden.com/blog/digitalocean-marketplace/ However, I'm curious what y'all think about the cost. A digitalocean droplet for the recommended specs (4 GiB memory) is $24/month. This is hard to stomach when you compare with Bitwarden Premium which is <$1/month. I guess it depends on how much you value your own data.
You can use vaultwarden, which is a re-implementation in Rust that is much more lightweight than the official .NET version.
I wish they would drop SQL for the self hosting and just use SQLite instead. That's what eats the most RAM on self hosting in .NET version.
Re: Bitwarden Acquires Passwordless.dev
#110As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.
The concern with Bitwarden started a few months back when they did a round of venture capital funding. Now, they have to turn profits instead of just being great.