Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

171–180 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#171

Post by mort96 »

thefz wrote: post #107
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

Bitwarden is built as a zero knowledge platform and they can't access the contents of your Vault.

Only if you never use the web interface.

Re: Bitwarden Acquires Passwordless.dev

#172

Post by kornhole »

worble wrote: post #79
sph wrote: post #53

Earlier quoted context omitted.

Ah for fuck's sake. It keeps happening to all the software I love. I guess I'll have to stop relying on convenience (I was a 1Password user years ago) and go 100% open-source. None of the libre offerings seem to be as convenient and polished, but at least they're not into some VC's pocket ready to squeeze as much profit as possible out of my paid membership. What's a good OSS alternative that works with iOS and Linux…

KeepassXC has served me well for many years, synced via my Nextcloud but could just as easily use dropbox or icloud, or even syncthing.

Yes KeepassXC is great. Nextcloud passwords is actively developed and looking good except for the Linux app failing on Arch.

Re: Bitwarden Acquires Passwordless.dev

#173

Post by notesinthefield »

manmal wrote: post #165
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

Keepass has Key Files as a part of the spec https://keepass.info/help/base/keys.html

On my devices, keyfiles and a KP client are stored locally. The DB rests in the cloud.

Re: Bitwarden Acquires Passwordless.dev

#174

Post by pavon »

kioleanu wrote: post #94
kjfarm wrote: post #48

Earlier quoted context omitted.

A good note for bitwarden is that it has a self hosting open source version, vaultwarden that is easy to switch to: https://github.com/dani-garcia/vaultwarden I see this as downside protection, as I can quickly migrate if I disagree with bitwarden's direction with minimal changes to my clients. I do worry about VC pressure on Bitwarden for hypergrowth. However in my personal opinion, the benefits outweigh the cons (f…

Note that Vaultwarden is the unofficial server, there is also an official one, that you can self host. Vaultwarden is much easier to set up and manage, I use it myself, and I heard that the official build is a little bit more tedious to go with.

The official server is distributed as docker containers, with a shell script to manage them, and is quite simple to setup and maintain. I could see how trying to deploy it yourself outside of docker could be an undertaking though.

The MSSQL database seems a bit heavyweight (RAM wise) given the tiny amount of data it needs to host for a handful of users, and isn't acceptable to some people on principle, since it isn't open source.

Re: Bitwarden Acquires Passwordless.dev

#175

Post by jjeaff »

CuriousCosmic wrote: post #80
radlad wrote: post #67

Earlier quoted context omitted.

It's open source and can be forked if necessary: https://github.com/bitwarden/mobile

To add onto this, if you care about supply chain attacks, bitwarden mobile supports Fdroid builds (albeit not part of the main repo because they rely on xamarin) so you can host your own fdroid repo and run your own builds if so desired.

If you are making your own build, is there a benefit to using f-droid? Why not just install the APK?

Re: Bitwarden Acquires Passwordless.dev

#176

Post by AdmiralAsshat »

WheatMillington wrote: post #154
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

Criminal negligence? Explain?

https://www.grc.com/sn/sn-905-notes.pdf

There are multiple users who, post-breach, are checking the Iteration Count the number of PBKDF2 iterations for their vault, and discovering that even though LastPass had been slowly increasing the number of iterations for new customers in line with industry best practices, they were never going back and upgrading the old users. So if you created a LastPass account in the past few years, your iteration count was 100,000. But if you were an older user, it may have only been 5,000. Or 500. Or, in the case of many old users: 1. One iteration. That's all that was protecting their encrypted vault--now in the hands of attackers--from brute forcing.

Re: Bitwarden Acquires Passwordless.dev

#177

Post by tazard »

weaksauce wrote: post #129
radlad wrote: post #67

Earlier quoted context omitted.

It's open source and can be forked if necessary: https://github.com/bitwarden/mobile

you don't need to fork it... just add an account at the main screen and set the backend url to whatever your server resolves to.

I think they meant if they don't like the direction that the Android client takes, i.e. they stop allowing you to change the backend url for example in which case, yes you would need to fork or rewrite it

Re: Bitwarden Acquires Passwordless.dev

#178

Post by jjeaff »

jrochkind1 wrote: post #160
secabeen wrote: post #158

Earlier quoted context omitted.

The entire finance industry has a disdain for "lifestyle businesses", that just generate enough profits for the founders and employees to live on, but will never generate an exit beyond that. I get why, but for utility products, a solid lifestyle for the employees and a useful product for users is enough, and should be enough.

And can be enough if you don't need large quantities of investment capital. If you don't _need_ it, but _want_ it to get fabulously wealthy... well, "lifestyle business" is not the path to that, by definition. It's almost like the interests of those who want to get fabulously wealthy -- whether founders or investors -- become misaligned with the interests of the users, even steeper/faster than when you "just" have a…

The thing is, founders can get fabulously wealthy with a lifestyle business or at least very wealthy, but it might take longer. But all the established money seeking rent parked at VC firms can't get a cut if you don't play ball with them.

Re: Bitwarden Acquires Passwordless.dev

#179

Post by hoboris »

waymon wrote: post #156
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

I used to do this. Now I self host vaultwarden since it allows me to use that database with faceID. Can keepass do that?

I use the Strongbox iOS client. It reads .kdbx files, integrates with apple sign-in features, and supports faceID.

https://apps.apple.com/us/app/strongbox-password-manager/id8...

Re: Bitwarden Acquires Passwordless.dev

#180

Post by noirscape »

lumb63 wrote: post #60
sph wrote: post #53

Earlier quoted context omitted.

Ah for fuck's sake. It keeps happening to all the software I love. I guess I'll have to stop relying on convenience (I was a 1Password user years ago) and go 100% open-source. None of the libre offerings seem to be as convenient and polished, but at least they're not into some VC's pocket ready to squeeze as much profit as possible out of my paid membership. What's a good OSS alternative that works with iOS and Linux…

I use KeePass. It’s up to you to sync passwords and they’re stored locally. I see those as features despite that they’re inconvenient.

Another advantage to KeePass is that there's about half a million clients and most are actually written to be used for their platforms.

Lots of more "modern" password managers (as well as generally other software) kinda suffer from having this weird mixed mobile and desktop interface, inheriting all the downsides of each interface while gaining the advantages of neither. (Not to mention all the issues with porting stuff between two different OSes; Mac and Windows have completely different ideas on what an interface should look like.)

KeePass's official client being windows-only is a blessing in disguise since it means that each client developer can specifically focus on making it look good on whatever specific platform they're targeting.

Post reply on HN