Bitwarden: Avoid at all costs (outage issue)

You own your data, get great UX thanks to their mobile clients/extensions.

Or… grab a Precursor[0] and import your bitwarden JSON export into its vault app :-)

[0]: https://betrusted.io/

I do both, self-host vaultwarden for a non-profit and have Bitwarden premium for personal use. A short while ago our server got nearly nuked and our Vaultwarden was down for several days, everyone in the org still could access all of our personal and shared passwords just fine, the extension and the clients stored all the necessary data offline and let us work uninterrupted until we restored the service ( ironically, it held the server's cloud provider credentials too ).

I suspect that in case of a complete outage or while not connected to the internet the client will work just fine, but on this instance something got messed up on the autentication/authorization side, so your client tried to authenticate to their server to sync up/do whatever it needs, since the server was not down but experiencing problems it received an error and logged you out.

I would argue this is by design, If the server returns an error while logging in there's probably a good reason, and especially in case of an organization account, you shouldn't have access to the passwords anymore.

You seem to have had major problems, but I assume it's likely your fault. You should not store all the means of accessing an account in a single place, I too store TOTPs on Bitwarden, but that's just for convenience, I have them on my phone Authenticator app too. But most importantly, as the name suggest, recovery codes ( which is what i assume your "temp verification passwords" are ) should be kept safe and in a separate place altogether, preferably printed even.

What you're describing here looks like nothing more than an outage, a thing that literally everyone and their dog experiences, from the non-profit like us to AWS, Microsoft, Google and Cloudflare.

Surely nothing to scream "Avoid at all costs" about.

Same for me.

>I suspect that in case of a complete outage or while not connected to the internet the client will work just fine, but on this instance something got messed up on the autentication/authorization side, so your client tried to authenticate to their server to sync up/do whatever it needs, since the server was not down but experiencing problems it received an error and logged you out.

If you're familiar with Bitwarden you're aware there is a Vault lock. When the laptop started and FF was launched, the extension got greyed out immediately. This means there's some sort of preflight init right after browser starts.

This behavior is not documented anywhere on their website in the troubleshooting section. And that was my first attempt to figure out the cause. Next thing was to reinstall the application and check if the problem goes away. And only after that the email to support was dispatched. So, enough effort was put before contacting BW staff. The error message is misleading[0]. So I went on to support forum[1] to learn this problem is recurring. And while I was typing my message, I have seen several messages deleted by the staff. Same happened with mine.

Given all that, where is my fault exactly?

>What you're describing here looks like nothing more than an outage, a thing that literally everyone and their dog experiences, from the non-profit like us to AWS, Microsoft, Google and Cloudflare.

It's an outage that indicated that you can loose access to BW Vault anytime they have an outage, means you can loose offline access even if the docs say otherwise[2]. To me it's false advertising at best given the iPhone's vault was in locked state as well but did not show any operational errors. Current BW users got aware of the incident and can draw conclusions and mitigate risks. I'm speaking for my experience and it's avoid at all costs now.

[0] https://imgur.com/a/y4qYcFL

[1] https://community.bitwarden.com/t/an-error-has-occured-acces...

[2] https://bitwarden.com/help/using-bitwarden-offline/

Extra bonus feature? For me it's pretty obvious it's a necessity. Failover need to be in ALL case offline access.

> My point was that while their software is extremely convenient, it should not be the only place that stores all the means of accessing a service

I can't have an automatic backup done over each new password stored on it. If I need to do it manually each time, it's no longer really a password manager.

I’ve happily used BW for years without problems. My experience is so far removed from what’s been posted here that I find it hard to take seriously at all. What an incredibly low quality post that does not live up to the standards of quality I expect on HN. There’s a proper way to voice concern and criticism, and this post is simply not that.

I’d like to hear dang’s thoughts. I believe the title should be edited and the OP text should probably be as well. To the OP, you missed the mark here, but I believe you can do better on your next post. Hopefully my criticism isn’t received too harshly as it’s intended to be helpful.