Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Avoid at all costs (outage issue)

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 137 posts

Re: Bitwarden: Avoid at all costs (outage issue)

#21

Post by intuxikated »

ath3nd wrote: post #4
cabbagesauce wrote: post #3

Earlier quoted context omitted.

You're one of the anon-Bitwarden boys? 1) I want sane error messages on the client side. 2) I want my feedback on community forums not to be shushed. You screwed up — own it. Community mods aren't janitors to wipe out user feedback. 3) I want the extension to be working no matter what kind of server-side problems you have. Let me know about a sync problem but don't terminate my access. But if you do think, that for $…

I can recommend Keeper (my current password manager of 2 years) or Passpack (previous password manager of 5 years). Never experienced any problems with either. I am surprised that they are not more popular than "fan-favorites" like LastPass which I absolutely can't stand (it's like from the dark ages UX wise) or 1Password, or, for that matter, Bitwarden. Bitwarden particularly experience degradation of service like e…

isn't keeper the one that sues people that disclose security vulnerabilities? I'd stay away as far as I can from that one.

Re: Bitwarden: Avoid at all costs (outage issue)

#24

Post by Canada »

_wldu wrote: post #22

The Design Flaws of Password Managers - https://www.go350.com/posts/the-design-flaws-of-password-man...

The design flaws of these systems are the fact that they are terrible at changing passwords, dealing with the arbitrary password requirements of many sites, and dealing with the fact that many sites require the storage of additional secrets for practical use that cannot be generated. (eg. secondary passwords or pin codes for privileged operations within the application, mandatory security questions, etc)

Re: Bitwarden: Avoid at all costs (outage issue)

#25

Post by cabbagesauce »

aborsy wrote: post #23

Even Google and AWS have outages. Bitwarden has rarely had issues. And this is all free service. Customer expectations have skyrocketed.

Hello. I'm paying for the service. My expectation is as simple as being able to log into the password manager when the cloud has an outage and I don't experience any problems. When they did disable my log in attempts, they showed the centralized — we own your data type of an issue.

Re: Bitwarden: Avoid at all costs (outage issue)

#26

Post by Georgelemental »

doodlesdev wrote: post #11
Georgelemental wrote: post #9

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

Another options is pass [0], which uses GPG to encrypt your stuff. Everything happens through the CLI but there are also GUI frontends for it. There's also gopass [1] which is very similar and compatible but does some extra stuff such as versioning with git. Similarly to this API compatibility there's KeePassDX [2] for mobile phones which is compatible with the KeePass database format. There's also KeePass [3] which…

I sync my database to my Android phone with Nextcloud, works great with KeePassDX

Re: Bitwarden: Avoid at all costs (outage issue)

#27

Post by AdamJacobMuller »

> remotely disable your browser extension which is assumed to work in offline mode

This seems incorrect.

I experienced this issue while I was working on 1 computer which I infrequently use so I was logged out of BitWarden. Trying to login gave me that oblique error message.

I was on a conference call (and presenting of course) so I needed the password Right Now so I pulled out my laptop, which was still logged in, and was able to access the password without issues.

I'm not sure exactly when this issue started/stopped, but, I probably use my phone vault 20x a day and I never saw the issue there either, only with the one computer which was logged out.

I really don't get all of the hate on here for BW. Are people annoyed or jealous because they just got funding? I understand people suggesting alternatives (and that's great -- monocultures are bad) but some of the comments on here (including, frankly, the OP's topic and message) are just rude.

I'm a user of both the hosted BitWarden and multiple VaultWarden_rs instances and it works well for me and meets my needs. It's been very reliable to the point where if I didn't see this post, I would have just assumed the earlier issue was some fluke and moved on without a 2nd thought.

I'll probably be accused of being a shill for them and legitimate criticism is warranted, but, too much of this seems like bad faith.

Re: Bitwarden: Avoid at all costs (outage issue)

#28

Post by aborsy »

doodlesdev wrote: post #11
Georgelemental wrote: post #9

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

Another options is pass [0], which uses GPG to encrypt your stuff. Everything happens through the CLI but there are also GUI frontends for it. There's also gopass [1] which is very similar and compatible but does some extra stuff such as versioning with git. Similarly to this API compatibility there's KeePassDX [2] for mobile phones which is compatible with the KeePass database format. There's also KeePass [3] which…

The good thing about Pass is that, it’s just a small bash script. It’s amazing how much it does with that footprint. It even provides QR code for transfer to phone. It has multiuser capability with multiple public keys and sharing, sync and versioning via git. There is almost no way there can be a vulnerability in the script, as you can just check it.

A touch on Yubikey will give you one password out (as opposed to unlocking the whole database). As secure as it gets!

Also very convenient to use, since the password is a short pin.

You can use CLI in scripts and handle tokens.

Good code written by a good guy!

Re: Bitwarden: Avoid at all costs (outage issue)

#29

Post by doodlesdev »

cabbagesauce wrote: post #19
doodlesdev wrote: post #15

Earlier quoted context omitted.

There is no lock-in to Bitwarden, stop spreading FUD. I'm not really sure how long this is going to be like this with the VC money, but right now: - Everything is open source - You get to self host - You get to export your database at any time - You don't even need to pay to use it if you don't want to Are local password managers objectively more secure and reliable? Yes. Does that mean that Bitwarden is just an awfu…

...not yet. Just as Authy was a nice TOTP software. Until they introduced their vendor lock-in TOTP format.

Authy was never open source, nor self hostable, nor did it allow you to export TOTP tokens. You also don't have to use their own TOTP format if you don't want to, in fact I've yet to see any website that actually uses it. The equivalent to Bitwarden when it comes to managing 2FA would be something like Aegis, which is open source and has feature parity with Authy.

[0]: https://getaegis.app/

Re: Bitwarden: Avoid at all costs (outage issue)

#30

Post by doodlesdev »

gremlinsinc wrote: post #16

I think maybe a good alternative type solution would be instead of a 'hosted' thing, I'd just like something like Bitwarden but your data gets pushed to devices it needs to be on, so it's always in a local database, and maybe you back it up to drive/dropbox easily, but the server just tracks when something changes/needs pushed and basically handles syncing stuff, other than that it doesn't keep any password data encr…

That's possible with KeePassXC (desktop) [0], KeePassDX (mobile) [1] and Syncthing [2]. Best thing about it is that the bridge between devices is also end-to-end encrypted, which is a nice bonus if you want to sync something else. I wish there was an easier all-in-one application for this kind of stuff though, would be much easier to maintain and setup for family/friends.

[0]: https://keepassxc.org/

[1]: https://www.keepassdx.com/

[2]: https://syncthing.net/

Post reply on HN