Live data from Hacker News

Bitwarden: Avoid at all costs (outage issue)

news.ycombinator.com

131–137 of 137 posts

Re: Bitwarden: Avoid at all costs (outage issue)

#131
post #56
post #47

Earlier quoted context omitted.

Or just use KeePassXC+nextcloud/syncthing as others have suggested, it's just an encrypted database with no cloud bullshit.

Can you please explain why this is an improvement over the parent comment solution?

Because KeePassXC (or any other offline password manager) cannot lock you out as long as you remember your password, and you can completely avoid storing your passwords in plaintext.

Re: Bitwarden: Avoid at all costs (outage issue)

#132
post #109

Earlier quoted context omitted.

You have to log in to the extension to unlock passwords every so often though right, more than once per browser session? Presumably that's server-authenticated, and what broke here.

There's no reason for that to involve a remote server. You have the local encrypted database. You have the key. Opening your front door doesn't require a trip down to the hardware store whe$e you brought it.

True, but if you go down that route there's no reason for a remote server at all. (Cf. pass.) I was just suggesting what seems to me a likely cause, since everyone was talking about 'phoning home' and 'remote disabling' as though it was intentional or more dodgy.

Re: Bitwarden: Avoid at all costs (outage issue)

#133
post #92
post #64

Earlier quoted context omitted.

I didn't find the sync that hard with pass and iOS (I'm sure Android has something equivalent): Set up a private git repo somewhere and configure passforios to pull from it. I have been running it for a few months now and it's smooth. This assumes you are on Linux or Mac.

Have they fixed the app? It used to not work at all for me https://github.com/mssun/passforios/issues/418

Sorry, I can't remember exactly how I imported the key, but what I did was generate new SSH ed25519 keypair, uploaded the public key as a deploy key to github, and then I think I copied the private key to iCloud and then accessed it that way.

Re: Bitwarden: Avoid at all costs (outage issue)

#134
post #64

Earlier quoted context omitted.

I didn't find the sync that hard with pass and iOS (I'm sure Android has something equivalent): Set up a private git repo somewhere and configure passforios to pull from it. I have been running it for a few months now and it's smooth. This assumes you are on Linux or Mac.

That's FANTASTIC. THANK YOU SO MUCH. I really cannot thank you enough. Google and Brave Search failed me but I found with Startpage this pass-compatible password manager for Android with sync through Git [0]. Amazing solution. Will probably migrate my passwords to this solution soon, only need to see if I can get something similar for Aegis TOTP and life will be good. [0]: https://passwordstore.app/

My pleasure! Ping me if you run into any issues. I also exported my TOTP keys from Authy and have them working from pass as well (using the pass otp plugin).

Re: Bitwarden: Avoid at all costs (outage issue)

#135
post #132

Earlier quoted context omitted.

There's no reason for that to involve a remote server. You have the local encrypted database. You have the key. Opening your front door doesn't require a trip down to the hardware store whe$e you brought it.

True, but if you go down that route there's no reason for a remote server at all. (Cf. pass.) I was just suggesting what seems to me a likely cause, since everyone was talking about 'phoning home' and 'remote disabling' as though it was intentional or more dodgy.

The remote server provides backup and sync in a convenient format which will lead to more people using password managers.

When it's down you only need to lose backup and sync.

Refusing to unlock your local database because it made some check on the backup and sync server is precisely remote disabling and is a great reason to transition off of bitwarden as it is a pretty good sign of them testing the waters for vendor lockin.

Post reply on HN