Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Get your passwords out of Bitwarden while you still can

osnews.com

Post reply on HN
Print view View original

131–140 of 203 posts

Re: Get your passwords out of Bitwarden while you still can

#131

Post by Esophagus4 »

BrandoElFollito wrote: post #100
scrollop wrote: post #55

Earlier quoted context omitted.

You should try hosting it yourself in docker. Absurdly easy to do if you get an llm to do it and it works very, very well. Hope they don't alter self hosting it.

It is absurdly easy to fire off the docker container you mean. Because you need to back up, verify backups, monitor availability, manage updates, manage MFA, and a zillion things. Don't get me wrong, I work in hardcore, high tech IT for 30 years and I selfhost two dozen or so of services. It is far, very far from "absurdly easy" when you start . Sure you can run a container on your pc, and hope for the best

Exactly.

I’ve seen this idea so many times on HN. “Just stand up a docker container and self-host”. Or even worse: “why does anyone need GitHub - just host Bitbucket yourself”

Ok, then what?

Re: Get your passwords out of Bitwarden while you still can

#133

Post by [deleted] »

BrandoElFollito wrote: post #100
scrollop wrote: post #55

Earlier quoted context omitted.

You should try hosting it yourself in docker. Absurdly easy to do if you get an llm to do it and it works very, very well. Hope they don't alter self hosting it.

It is absurdly easy to fire off the docker container you mean. Because you need to back up, verify backups, monitor availability, manage updates, manage MFA, and a zillion things. Don't get me wrong, I work in hardcore, high tech IT for 30 years and I selfhost two dozen or so of services. It is far, very far from "absurdly easy" when you start . Sure you can run a container on your pc, and hope for the best

[deleted]

Re: Get your passwords out of Bitwarden while you still can

#134

Post by Esophagus4 »

NoGravitas wrote: post #90
kqp wrote: post #73

Earlier quoted context omitted.

It’s phones, mainly. People do also have multiple other devices, yes. For me another big pro is having a realtime offsite backup and being able to survive simultaneous loss of all my devices, which is plausible in correlated scenarios like a burglary, fire, mugging, car crash, etc, but I don’t know how much others think of that one. The people I know who use KeePass live like they’re disabled. You ask them to sign up…

Weird. I keep my KeePass database on NextCloud, and the only difference between home and phone is that on a bad network I may need a few seconds for KeePassDX on the phone to decide to use its cached copy of the database rather than the latest one. It would probably be even smoother if I used Syncthing. I assume non-technical people ought at least be able to put their KeePass files on DropBox?

> I assume non-technical people ought at least be able to put their KeePass files on DropBox?

Non-technical people would not do something this complicated. They don’t even have password managers, let alone a setup like this.

Shoot, even a lot of technical people (like me) wouldn’t bother with this. It’s why I pay for a cloud-based password manager.

Re: Get your passwords out of Bitwarden while you still can

#135

Post by tensor »

baal80spam wrote: post #26
e40 wrote: post #22

Earlier quoted context omitted.

A bad idea for you. My non-technical family members can barely use 1Password and it is the easiest of the lot. The idea you promote is just not realistic.

Not really. That something is convenient doesn't mean that it's a good idea. It's always a matter of convenience vs security.

When people had to rotate passwords every month and choose a new one according to insane complex rules and dictionary tests, well, that was not convenient. You would probably say it's good.

Reality: people started writing their passwords on sticky notes by their computer. Possibly the worst outcome.

Convenience is part of good security.

Re: Get your passwords out of Bitwarden while you still can

#136

Post by tadfisher »

wfleming wrote: post #64
ab71e5 wrote: post #37

Earlier quoted context omitted.

I'm interested in this, what do you use to host the git repo? Just a private repo on something like github or your own server? How do you backup your private key?

I also use pass. Any forge you feel like is fine (I use gitlab). I backup my gpg key with `gpg —export-owner-trust` and store that backup elsewhere. Pass has a pretty good ecosystem of plugins/other clients, as well. There are open source iOS/Android clients and browser extensions so once you’re setup the day-to-day experience is not far off from any of the popular hosted password managers. My only real issue is the…

It's next-to-impossible to implement pass on every device everywhere and have all the same features on each client without reimplementing all of GnuPG. It pushes a lot on to GnuPG.

God help you if you want to use the PGP applet on a Yubikey or smartcard. The pieces all exist, but wiring them all up in a mobile app is hard and the result is janky.

Re: Get your passwords out of Bitwarden while you still can

#137

Post by craigmart »

jjulius wrote: post #121
craigmart wrote: post #67

Earlier quoted context omitted.

I had checked as soon as I found out about the news the other day and it was there. I just checked on wayback machine and you're right, it was removed for some time. However, if they're willing to put back that claim immediately, I doubt that their intention was to drop the free plan anytime soon, but probably it was to incentivize people to use the paid plans. Enshittification must happen sooner or later afterall, b…

>Enshittification must happen sooner or later afterall... No it absolutely must not.

You're right, pardon my cynical remark. I'm just disillusioned by the promises of most tech companies

Re: Get your passwords out of Bitwarden while you still can

#139

Post by rootsudo »

It’s good to review, but what is the risk if you do become a paying customer?

Paying mean they have revenue, an interest to keep it secure and innovate more.

I recall last pass and the last pass breech and the class action from that but that resulted from improper crypto rollout.

Would the same risk happen with Bitwarden?

Re: Get your passwords out of Bitwarden while you still can

#140

Post by prism56 »

scrollop wrote: post #55
tfarias wrote: post #31

I've been recommending Bitwarden for a few years now and have also been paying a yearly sub since 2022, as I always thought 10$ was a really good value. But with all this stuff coming out, I'm holding off on recommending it anymore; at least until everything calms down and the new value proposition is fully laid out. Like other folks have said, I don't think it's yet time to migrate. That being said, it doesn't hurt…

You should try hosting it yourself in docker. Absurdly easy to do if you get an llm to do it and it works very, very well. Hope they don't alter self hosting it.

Cant tell if this is satire. But I'm not self hosting my passwords unless I fully understand exactly what's happening. Trusting that to an LLM without really understanding what's happening seems very risky to me.
Post reply on HN