Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

161–170 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#161

Post by tunesmith »

secabeen wrote: post #158
ok_dad wrote: post #148

Earlier quoted context omitted.

> Ah for fuck's sake. I agree, and I wish we had more power in these things than just forking. Now that I know Bitwarden took VC money, I'm also fucking out of this mess, and here I was about to renew for the 5th year in a row. Fuck VC's, they ruin everything good. Can I say that here? It's true.

The entire finance industry has a disdain for "lifestyle businesses", that just generate enough profits for the founders and employees to live on, but will never generate an exit beyond that. I get why, but for utility products, a solid lifestyle for the employees and a useful product for users is enough, and should be enough.

Lifestyle businesses have a big flaw in American culture though; our safety net is not enough to make "meets expenses" a tenable long-term approach. We basically have to aim for a big wad of savings for later in life, which incentivizes going for exits and cash-outs.

Re: Bitwarden Acquires Passwordless.dev

#162

Post by panarky »

RadiozRadioz wrote: post #123
thefz wrote: post #107

Earlier quoted context omitted.

Bitwarden is built as a zero knowledge platform and they can't access the contents of your Vault.

So is LastPass, but we users changed our passwords in December anyway as a precaution. Bitwarden is still a central entity that needs to be trusted to manage the zero knowledge platform with competence, e.g. not storing unencrypted metadata in a backup.

Because LastPass is a bad actor that falsely claimed to have a "zero knowledge architecture" that couldn't be compromised if they were hacked, and kept their code secret so nobody could independently assess their implementation, and then proceeded to store critical user data unencrypted, which was promptly hacked and leaked, that means the risks must be identical with Bitwarden, which publishes client and server code in public, so anyone can inspect their implementation.

Re: Bitwarden Acquires Passwordless.dev

#163

Post by orhmeh09 »

bsg75 wrote: post #143
mbesto wrote: post #134

Earlier quoted context omitted.

> VC funds and acquisitions are rarely good for users Where does this sentiment come from? I know very few applications I use that are VC funded or haven't gone through acquisitions...

It comes from a concern that VC backed investments demand a constant level of revenue growth, causing a company to add features or integrations that do not improve the base product. Organic growth is usually insufficient for stockholders, whose demands become a priority over stakeholders. If the user base does not increase at some rate determined by the investor, then growth comes in the form of advertising, partners…

This does not stem from VC but from the “C” itself - capital. In order to function in capitalism, production must facilitate the creation of surplus value that can then be appropriated. Over time, with the tendency of the rate of profit to fall and with inflation of prices, you will see a race to the bottom.

Re: Bitwarden Acquires Passwordless.dev

#164

Post by sngz »

gagabity wrote: post #13
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

was considering switching, guess I'll stick to keepass

Re: Bitwarden Acquires Passwordless.dev

#165

Post by manmal »

obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

Re: Bitwarden Acquires Passwordless.dev

#166

Post by echeese »

PassageNick wrote: post #36
xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

(Full disclosure: I work at https://passage.id ) WebAuthn is the short name for the "FIDO Alliance Web Authentication Protocol". "Passkey" is the trade name (that Apple tries to own) for the "stuff" that results from using the WebAuthn protocol. At it's root, a passkey is really the private key portion of that "stuff" that is kept. So yes, in practice, a passkey is the result of a WebAuthn implementation. MS, Apple,…

I don't think Apple is trying to own the name passkey. Quote from this video: https://developer.apple.com/videos/play/wwdc2022/10092/

> Here are some guidelines for how to refer to passkeys in your apps and websites. "Passkey" is a generic, user-visible term. This video focuses on Apple's implementation, but as I've just shown you, other major platforms have already started building their own support for passkeys. "Passkey" is also a common noun, like "password." In English, this means it's lowercase and gets pluralized like "password" would. I have a passkey for my account, and I can go to Settings to view all of my accounts with passkeys.

Re: Bitwarden Acquires Passwordless.dev

#167

Post by fantalamera »

jlundberg wrote: post #2

And here is a link to the web site of this startup: https://www.passwordless.dev/ Anders Åberg (@andersaberg) who is the founder behind this is a really enthusiastic and inspiring coder. I've always enjoyed his mashup hackathon ideas and meetup presentations. :-)

Anders is amazing!

Re: Bitwarden Acquires Passwordless.dev

#168

Post by jeroenhd »

yshavit wrote: post #73
tapland wrote: post #30

Earlier quoted context omitted.

Aren’t you supposed to have your personal Bitwarden account and get work passwords shared to your account? I thought that’s how Bitwarden for organisations worked.

Ideally I'd want to keep my _personal_ personal stuff separate from my "work personal" (ie my personal logins, but the one for work accounts) separate from my shared work stuff. So I'd want two accounts, one for my truly personal accounts, and then one for my work-personal and have the work-shared connected to that.

I don't know how well this works across business and personal accounts, but you can use "collections" to share passwords between accounts.

I'm using that on my VaultWarden server to share data between different accounts and it works well for me. This may not work in your specific situation if your company manages your Bitwarden account, though.

Re: Bitwarden Acquires Passwordless.dev

#169

Post by aheckler »

velhartice wrote: post #117
ESchack wrote: post #85

Earlier quoted context omitted.

I did this some time ago when 1Password announced switching from having native apps to being containerized web apps. Have not regretted it one bit.

Bingo, me too. I like that keepass is file based so I can use any storage medium to make multiple layers of security to access the vault. Even if cloud providers have access to the file or my cloud storage account gets hacked they still have to crack the file to get the passowrds. Also I have been using strongbox pro for a few years now and been very happy, in fact I like it better than what 1password used to be. Wor…

I've been considering a switch from 1Password to KeepassXC myself, but the last time I tried it, I couldn't find if KeepassXC has some equivalent to the "quick access" feature of 1Password.[0] In short, a way to open a small window, search for a service name or URL, and then quickly copy username, password, or a TOTP code. As far as I could tell, I had to open the entire KeepassXC app every time to find something. Has this changed, or did I miss something somehow?

[0] https://support.1password.com/quick-access/

Re: Bitwarden Acquires Passwordless.dev

#170

Post by jeroenhd »

metaltyphoon wrote: post #109
wallmountedtv wrote: post #63

Earlier quoted context omitted.

You can use vaultwarden, which is a re-implementation in Rust that is much more lightweight than the official .NET version.

I wish they would drop SQL for the self hosting and just use SQLite instead. That's what eats the most RAM on self hosting in .NET version.

Based on their current docker-compose file, it seems like they did away with the MS SQL server, at least: https://github.com/bitwarden/server/blob/master/docker-unifi...

[This issue](https://github.com/bitwarden/server/pull/2487) also suggests SQLite was added as a database driver last December.

Post reply on HN