Earlier quoted context omitted.
Desktop: keepass variants. Android: Keepass2 android. Use syncthing to stay in sync.
How to use Syncthing on Android now that the app has gone?
There is a fork:
https://github.com/Catfriend1/syncthing-android
Bitwarden SDK relicensed from proprietary to GPLv3
141–150 of 381 posts
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#142This update is great news. I was disappointed to see the issue that got raised last week, and I had started to consider looking for alternatives. I’m going to assume an honest mistake on their end and keep recommending their product. However, if they make a similar move again, I will assume the worst and move on.
To be fair, Bitwarden clients are mostly GPL and can be forked, and there's Vaultwarden for self-hosting.
We just need to rally together a community that would maintain such a fork.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#143Not entirely there yet ... Some parts of have been re-licensed, some have been licensed under the old non-free software SDK license. E.g,
https://github.com/bitwarden/sdk-internal/commit/db648d7ea85...
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#144Earlier quoted context omitted.
There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis o…
It's still 2 factors though, if someone discovers your password they don't automatically know the TOTP key. So I use TOTP in my password manager for sites where I wouldn't use 2FA otherwise (because using my phone would be inconvenient), so it's still a security improvement for me. And for critical accounts I do use Aegis on my phone.
That's not 2FA, that's two of the same factor.
The factors are:
- Something you know
- Something you have
- Something you are (biometrics)
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#145Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.
I actually switched from Firefox's password manager to Bitwarden. There used to be a bug on Android where the autofill button sometimes would stop doing anything.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#146No good thing ever lasts, especially in the world of tech. So, I'll be sticking with Bitwarden until they somehow eventually fuck it up and something else takes its place.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#147Earlier quoted context omitted.
I store the password vault in dropbox. Done.
100% serious question: how is using dropbox (one cloud) to sync passwords any better or more secure than using a password manager that syncs your vault for you (another cloud)? I see so many "I don't trust so I use dropbox" comments around these parts and I just don't understand what real or perceived threat is being mitigated.
It's valuable that the syncing mechanism is seperate because that makes it agnostic. Parent comment uses Dropbox, I use Google Drive, someone else uses OneDrive, someone else uses iCloud, someone else uses Syncthing or Nextcloud, etc.
You don't have to trust the single cloud provider to encrypt and not be able to spy. The vault is encrypted on your own device using fully open software, and the cloud only ever sees a blob they have no keys to, directly or indirectly. The encrypting/decrypting software was not written by the cloud provider.
You don't have to trust any single cloud provider to stay up, be available in your country, stay friendly to you. If Dropbox goes down or kills your account, you just flip to any of 20 other options.
You say you don't understand why someone prefers Dropbox over the special custom syncing, but I don't understand what the excuse is for a special vendor-specific implimentation of something that is already generic and agnostic. It's like using a browser that uses it's own version of http to download files and only works with one web site that has the matching special server.
It's not a remotely equivalent comparison between "one cloud" and "another cloud". One is a single vendor-specific, custom purpose, single-provider thing, the other is agnostic and infinite, use any method you want from any provider you want any time you want.
For me it's not about "mitigating a real or percieved threat". It's just basic system resilience and principle to avoid special things and prefer generic/agnostic things, and keep concerns seperated. But it is also more secure not to trust any integrated cloud provider, vs having the cloud be just storage that doesn't know anything about the blob being stored, and can't even if they turn bad, or are pressured by a government, or get hacked, etc.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#148Earlier quoted context omitted.
Firefox isn't end-to-end encrypted either anymore, IIRC.
They say it is: https://support.mozilla.org/en-US/kb/sync
I stand corrected! https://support.mozilla.org/en-US/kb/reset-your-firefox-acco...
> Mozilla accounts uses your password to encrypt your data (such as bookmarks and passwords) for extra security. When you forget your password and have to reset it, this data could be erased. To prevent this from happening, generate your unique account recovery key before forgetting or resetting your password.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#149Thank you Bitwarden for listening. This kind of stuff gives me hope for the business model of Open Source.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#150Bitwarden is still excellent, but keep an eye on them over the next few years. Remember that Bitwarden was originally a LastPass alternative without the fuckery.
The LastPass fuckery was long and frankly egregious. Though I don't understand why this git commit is what's linked here. I'd rather hear the discussions on it. https://github.com/bitwarden/clients/issues/11611
After reading through the issue thread and the final reply by Bitwarden, I think the only context this provides is that the headline should rather be something like "Bitwarden SDK fixes dependency licensing issue".
The opening comment and the final reply are the only valuable contributions in that issue. Everything in between is random people jumping in to feign outrage or telling people to use Vaultwarden (which btw recently was in the news for more significant negative reasons). If anything it's a perfect example of the sad state of online discourse.