Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

121–130 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#121

Post by velhartice »

sigzero wrote: post #47
Jack5500 wrote: post #5

Slightly offtopic, but I really find the Bitwarden Clients to be lacking in the feature department. I switched to Bitwarden a few month ago and the client has evolved (for me) ever since. There are a few basic features missing, such as that if I search for something I wrote in the notes of password, that the client shows the according password. I get that the open-source model implies that everyone can contribute and…

Bitwarden (for me) is still a little clunkier in how it does things compared to 1Password. I find 1Password a much smoother experience.

KeepassXC and/or strongbox have a very similar workflow to the older file based 1password one. I switched from 1password once they went to the centralized subscription model and I have been very happy with it for years now.

Re: Bitwarden Acquires Passwordless.dev

#122

Post by babypuncher »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

I know this dead horse has probably been beaten beyond recognition, but I think the safest option that still preserves some convenience for password management is to stick a keepass database in your cloud storage provider (icloud/dropbox/whatever).

Some keepass compatible apps even offer full iOS integration (FaceTime unlock, Password AutoFill), so you don't lose these features you're used to with LastPass.

Re: Bitwarden Acquires Passwordless.dev

#123

Post by RadiozRadioz »

thefz wrote: post #107
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

Bitwarden is built as a zero knowledge platform and they can't access the contents of your Vault.

So is LastPass, but we users changed our passwords in December anyway as a precaution. Bitwarden is still a central entity that needs to be trusted to manage the zero knowledge platform with competence, e.g. not storing unencrypted metadata in a backup.

Re: Bitwarden Acquires Passwordless.dev

#125

Post by selykg »

panzi wrote: post #103
jorvi wrote: post #52

Earlier quoted context omitted.

I switched from 1Password to Bitwarden, imported my vault, and then realized that their client doesn’t even support drag ‘n drop. I’ve been wanting to switch from 1Password to Bitwarden for years, but each year I try it I’m just flummoxed by how atrociously behind the UX / UI still is. Unless you (or whoever you’re getting to switch) are an absolute open source absolutist: do yourself a favor and go for 1Password.

Bitwarden is the first password manager I ever used. Where would it use drag and drop and for what? I wish it would be better controllable vie keyboard-only. That is, when you use the Firefox add on and tab out of the Bitwarden popup and tab back in again it remembers the focus on e.g. the copy password button, you just have to hit space again and tab back to the terminal window where you need to use the password. Bu…

In 1Password there's at least a half dozen ways that drag and drop could be used:

- Drag a password into a password field

- Drag an attachment from Finder/Explorer into an item

- Drag an item from vault to vault (or collection in Bitwarden parlance)

- Drag an item into a tag or folder to add that item to the folder, or add that tag to the item

- Drag an app to the 1Password icon to create a software license item with the icon of the app as well as name

There are also drag and drop functions, some similar to above, on iOS as well.

Bitwarden is... and I agree with the grand parent here, awful from a UX angle, compared to 1Password. It's certainly functional, but that's about where it ends for me.

Re: Bitwarden Acquires Passwordless.dev

#126

Post by PassageNick »

_8j50 wrote: post #111

Passwordless as a concept needs to die along with biometric auth. You have really good newer methods of auth. Instead of selling them as good MFA alternatives security vendors decided to replace passwords because that differentiates them more. But in reality, the layer of defense "what you know" should be complemented not replaced. A reduction in security being sold as a feature is dishonest and harmful.

The threat surface of a password based system is like Lake Superior.

The threat surface of a passkey based solution is like a small puddle after a rain.

How is there a "reduction" in security here?

Re: Bitwarden Acquires Passwordless.dev

#127

Post by TillE »

obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

BitWarden doesn't get "complete access to your digital life", they get an encrypted blob.

It's not materially different than storing your KeePass vault in the cloud.

Re: Bitwarden Acquires Passwordless.dev

#128

Post by mdaniel »

penciltwirler wrote: post #49

One can easily self host a bitwarden server on digitalocean. https://bitwarden.com/blog/digitalocean-marketplace/ However, I'm curious what y'all think about the cost. A digitalocean droplet for the recommended specs (4 GiB memory) is $24/month. This is hard to stomach when you compare with Bitwarden Premium which is <$1/month. I guess it depends on how much you value your own data.

Aside from the highly relevant cost observations of the sibling comments, one will want to be cognizant of the ... very strange .. opsec that installer uses. It's a lot of curl into bash, self-updating things, url shorteners, and :latest tags

discussed when it was announced: https://news.ycombinator.com/item?id=31098608

Re: Bitwarden Acquires Passwordless.dev

#129

Post by weaksauce »

radlad wrote: post #67
omnicognate wrote: post #61

Earlier quoted context omitted.

Vaultwarden's great. I use it. I use the Bitwarden Android client, though. Not sure what there is to replace that.

It's open source and can be forked if necessary: https://github.com/bitwarden/mobile

you don't need to fork it... just add an account at the main screen and set the backend url to whatever your server resolves to.

Re: Bitwarden Acquires Passwordless.dev

#130

Post by sampling »

chriscjcj wrote: post #98
cdev_gl wrote: post #35

Earlier quoted context omitted.

This is true, but LastPass proved that by the time the worst case occurs it's already too late. A security breach means, at minimum, redoing all your passwords, and these sites are a very compelling target. OTOH I wouldn't want to self-host because I know I'm not going to spend the same amount of time and effort a full security staff would, even if my self-hosted box would make a much less attractive target. It's qui…

I self-host Vaultwarden. I'm sure someone will be happy to explain to me how foolish my implementation is, but I'm comfortable with it from a security perspective. I run it as a Docker instance on my home Synology NAS. This turned out to be pretty easy to do. The only part that was a slight hassle was buying a cert, creating an FQDN and making the DNS entries to get an SSL connection to the NAS. Also, I wish updating…

I have a very similar self-hosted Vaultwarden set up, for the same reasons.

My other concern, which may be unfounded is that Vaultwarden [1], which is an unofficial Rust rewrite, may also be developed to different, or lesser security standards than the official client. However I don't have any real reasons to suspect this.

[1] https://github.com/dani-garcia/vaultwarden

Post reply on HN