Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

201–210 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#201

Post by Y_Y »

sph wrote: post #53
gagabity wrote: post #13

Earlier quoted context omitted.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

Ah for fuck's sake. It keeps happening to all the software I love. I guess I'll have to stop relying on convenience (I was a 1Password user years ago) and go 100% open-source. None of the libre offerings seem to be as convenient and polished, but at least they're not into some VC's pocket ready to squeeze as much profit as possible out of my paid membership. What's a good OSS alternative that works with iOS and Linux…

I haven't seen, but would love to, a tech startup that is guaranteed not to sell out. I don't mean a promise from the founder on a blog, but a legal structure. I'm not sure what what form this would take or if it's such anathema that it could never be but it would be great to see.

I'm sure I'm not the only one who's tired of the bait-amd-switch of companies who are all about freedom until they get acquired by a giant and then start hastily walling their garden.

Re: Bitwarden Acquires Passwordless.dev

#202

Post by sirsinsalot »

dahfizz wrote: post #93
zucked wrote: post #39

Earlier quoted context omitted.

I'm happy for the one dev who's been lone rangering as I hope it means he's finally getting paid, but the pressure is going to be on to get an ROI.

Insane radical idea: Businesses can actually make a profit by having income higher than expenses. You can pay yourself that way.

What does "make a profit" mean? Is that the money from IPO? Or money laundering? Idgi

Re: Bitwarden Acquires Passwordless.dev

#203

Post by Ajedi32 »

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023.

That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. I'm hopeful Bitwarden will solve that problem, and that their example will encourage other popular password managers to do the same.

(...or at least, I think "passkey support" means they plan to support storing passkeys in Bitwarden itself. I hope it doesn't just mean they want to let you use a passkey to log in to Bitwarden. That'd be really disappointing, and probably a poor choice strategically given that passkeys aim to eventually render traditional password managers obsolete.)

Re: Bitwarden Acquires Passwordless.dev

#204

Post by 9dev »

judge2020 wrote: post #14

This seems a bit odd to me - is setting up WebAuthn in your main backend so hard that an external service like this for validating credentials is required?

I recently implemented WebAuthn for a toy project, and while it took a bit to wrap my head around the details, it’s fairly straightforward if you know the problem domain a bit.

I’d say we’re going to see polished libraries soon that will abstract all the details away, but services like this may help less experienced developers to quickly get secure auth working.

Re: Bitwarden Acquires Passwordless.dev

#205

Post by stavros »

obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

I kind of want to point out the discrepancy in saying "I get syncing without sharing my data with anyone by sending my password database to Apple". If your argument is that the database is encrypted, how is Bitwarden different?

Re: Bitwarden Acquires Passwordless.dev

#206

Post by sirsinsalot »

bluSCALE4 wrote: post #110
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

The concern with Bitwarden started a few months back when they did a round of venture capital funding. Now, they have to turn profits instead of just being great.

Not being a non profit or charity, I'm fairly sure profit was a need for sustaining the business before investment.

Re: Bitwarden Acquires Passwordless.dev

#207

Post by hn_throwaway_99 »

brandon272 wrote: post #183
manmal wrote: post #165

Earlier quoted context omitted.

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

LastPass would have also led their customers to believe that "brute forcing was not possible" and that they were taking extraordinary measures to keep vaults and data safe. I think one distinction between services like KeePass and 1Password is end user perception of how easy it is for an attacker to acquire an encrypted vault to begin with. For many, they consider a KDBX database sitting in their Dropbox account to b…

Doesn't necessarily matter what LastPass "would have also led their customers to believe", the mathematical reality is still that LassPass vaults are crackable in a way that 1P vaults fundamentally are not.

Re: Bitwarden Acquires Passwordless.dev

#208

Post by sirsinsalot »

rvz wrote: post #19
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

I'd like to remind you that Bitwarden is becoming completely VC backed with the way it is going [0] and there is always a possibility that it can be acquired to give investors a return. The same happened with Keybase as soon as they took VC cash. It is now growth at all costs until an eventual acquisition of Bitwarden. So I won't be surprised to see price increases on some plans soon. [0] https://bitwarden.com/blog/a…

The keybase pivot was so ugly and sad. Their pre VC product was really nice.

Re: Bitwarden Acquires Passwordless.dev

#209

Post by noahtallen »

Ajedi32 wrote: post #203

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023. That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. I'm hopeful Bitwarden will solve that problem, and that their example wi…

1Password is also working on it: https://www.future.1password.com/passkeys/

It’s shaping up to be a cool year for password management!

Re: Bitwarden Acquires Passwordless.dev

#210

Post by 8organicbits »

StreamBright wrote: post #71

I am not sure how much is this better than magic link logins.

Magic links via email? Email isn't a secure transport, or storage. I think that's only viable for low risk systems. Even software like Slack, which supports magic links via email, will also support username/password/MFA as an option for folks who need better security.
Post reply on HN