Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

181–190 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#181

Post by princevegeta89 »

omnicognate wrote: post #61
kjfarm wrote: post #48

Earlier quoted context omitted.

A good note for bitwarden is that it has a self hosting open source version, vaultwarden that is easy to switch to: https://github.com/dani-garcia/vaultwarden I see this as downside protection, as I can quickly migrate if I disagree with bitwarden's direction with minimal changes to my clients. I do worry about VC pressure on Bitwarden for hypergrowth. However in my personal opinion, the benefits outweigh the cons (f…

Vaultwarden's great. I use it. I use the Bitwarden Android client, though. Not sure what there is to replace that.

Is it not possible to point BW Android to your Vaultwarden instance?

Re: Bitwarden Acquires Passwordless.dev

#182

Post by fortuna86 »

tunesmith wrote: post #161
secabeen wrote: post #158

Earlier quoted context omitted.

The entire finance industry has a disdain for "lifestyle businesses", that just generate enough profits for the founders and employees to live on, but will never generate an exit beyond that. I get why, but for utility products, a solid lifestyle for the employees and a useful product for users is enough, and should be enough.

Lifestyle businesses have a big flaw in American culture though; our safety net is not enough to make "meets expenses" a tenable long-term approach. We basically have to aim for a big wad of savings for later in life, which incentivizes going for exits and cash-outs.

This also means creation of billion dollar global platforms that Europe and other parts of the world have never accomplished. Trade offs.

Re: Bitwarden Acquires Passwordless.dev

#183

Post by brandon272 »

manmal wrote: post #165
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

LastPass would have also led their customers to believe that "brute forcing was not possible" and that they were taking extraordinary measures to keep vaults and data safe.

I think one distinction between services like KeePass and 1Password is end user perception of how easy it is for an attacker to acquire an encrypted vault to begin with. For many, they consider a KDBX database sitting in their Dropbox account to be less likely to be stolen than an encrypted vault being held by a company like 1Password, a high value target to the most sophisticated attackers including state actors.

Re: Bitwarden Acquires Passwordless.dev

#184

Post by princevegeta89 »

ssgodderidge wrote: post #84
cpsns wrote: post #44

Earlier quoted context omitted.

> Bitwarden recently raised 100M from VC I wasn’t aware of this, but I’m glad I am now. If that’s the case it’s time to look elsewhere or self host, VC funds and acquisitions are rarely good for users so I’ll assume the worst.

My guess is they will follow 1Password and have more strategies to monetize users. I wonder what the difference between the two services will be at the end of the day.

1Password in my experience was the biggest scum of bait and switch I ever faced. They used to do "lifetime" licenses which I bought into, but wouldn't support it beyond one year of release and stop giving me updates. Later, they invested heavily into the cloud side of things, and brought in confusing subscription-based pricing which made it expensive and difficult to understand. All they're doing as of now is trying to increase prices and tear into your pockets.

With BW I have never expected the same and I am still hopeful on giving them the benefit of doubt.

Re: Bitwarden Acquires Passwordless.dev

#185

Post by xwowsersx »

0xCMP wrote: post #20
xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

Passkeys is the "normal" name for a FIDO2/WebAuthn credential that basically lives within a phone or password manager. It does add a few things. Namely the ability to store many passkeys per device per app/site, the ability to sync those passkeys (e.g. via iCloud or similar), and the ability to use QR codes and Bluetooth to do a local-only authentication on a device which doesn't have the passkey (which is what often…

Thanks for the info and for the podcast link. Going to give that a listen.

Re: Bitwarden Acquires Passwordless.dev

#186

Post by princevegeta89 »

switch007 wrote: post #51
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

I’d bet on KeePass 2 longer term. KeepPassCX has been around 10 years (forked from a project started 8 years before that). Actively developed, cross platform. There are decent apps for android and iOS (eg Strongbox) I’m going to migrate off 1Password to it soon

What is the best client for Keepass on Android? How is the autofill functionality?

Re: Bitwarden Acquires Passwordless.dev

#187

Post by xwowsersx »

PassageNick wrote: post #36
xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

(Full disclosure: I work at https://passage.id ) WebAuthn is the short name for the "FIDO Alliance Web Authentication Protocol". "Passkey" is the trade name (that Apple tries to own) for the "stuff" that results from using the WebAuthn protocol. At it's root, a passkey is really the private key portion of that "stuff" that is kept. So yes, in practice, a passkey is the result of a WebAuthn implementation. MS, Apple,…

Thanks.

> What the "Big Three" do is leverage their OS's and platforms to enable the storage and migration of passkeys within their eco-system. WebAuthn is implemented in their browsers, and they enable the use of passkeys (which websites make happen via implementing WebAuthn).

That was really helpful, I think that was the bit I was missing.

Re: Bitwarden Acquires Passwordless.dev

#188

Post by roustem »

afavour wrote: post #56
jorvi wrote: post #52

Earlier quoted context omitted.

I switched from 1Password to Bitwarden, imported my vault, and then realized that their client doesn’t even support drag ‘n drop. I’ve been wanting to switch from 1Password to Bitwarden for years, but each year I try it I’m just flummoxed by how atrociously behind the UX / UI still is. Unless you (or whoever you’re getting to switch) are an absolute open source absolutist: do yourself a favor and go for 1Password.

I did try to switch a year or so ago and got really frustrated. Tried again a week ago and Bitwarden does seem a little better. It helps that it feels like 1Password's app has been getting more bloated over time (though I have no data to support that assertion).

1Password certainly added a ton of new features recently :)

Did you check 1Password developer tools, like SSH-agent server, git commit signing, and CLI? https://developer.1password.com/

Or the new item and file sharing. https://support.1password.com/share-items/

Re: Bitwarden Acquires Passwordless.dev

#189

Post by princevegeta89 »

manmal wrote: post #165
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

Same was said about LastPass many times and look at what happened, everything turns out to be a false promise.

Re: Bitwarden Acquires Passwordless.dev

#190

Post by nightski »

Spivak wrote: post #136
kioleanu wrote: post #94

Earlier quoted context omitted.

Note that Vaultwarden is the unofficial server, there is also an official one, that you can self host. Vaultwarden is much easier to set up and manage, I use it myself, and I heard that the official build is a little bit more tedious to go with.

The official one used to only support MS SQL and other DBs are still “mileage may vary” so people were uhh pretty motivated to make something else.

Interesting, I use ms sql a lot so that’s actually a plus for me.
Post reply on HN