Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

211–220 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#211

Post by roustem »

ESchack wrote: post #85
switch007 wrote: post #51

Earlier quoted context omitted.

I’d bet on KeePass 2 longer term. KeepPassCX has been around 10 years (forked from a project started 8 years before that). Actively developed, cross platform. There are decent apps for android and iOS (eg Strongbox) I’m going to migrate off 1Password to it soon

I did this some time ago when 1Password announced switching from having native apps to being containerized web apps. Have not regretted it one bit.

The "containerized web app" is not a correct description here. 1Password 8 on macOS, Windows, and Linux is a full-fledged desktop app. It is built in Rust with Electron/React providing the UI. It can work completely offline and does not require a network connection.

1Password 8 has greatly improved security architecture compared to the previous versions. Just one example of many: when rendering the item details, the Rust core would not send the password value to the UI layer until the user clicks "Copy" or "Reveal" password.

In addition to that, 1Password 8 has better integration with the operating system that any other version in the past — Touch ID, Windows Hello, Secure Enclave, macOS Accessibility services, etc, etc.

Re: Bitwarden Acquires Passwordless.dev

#212

Post by echeese »

heresjohnny wrote: post #101

Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?

Probably the same thing that happens when you forget your password. Hit the "forgot your password" link, get a confirmation email, create a new passkey

Re: Bitwarden Acquires Passwordless.dev

#213

Post by dcow »

mort96 wrote: post #155
TillE wrote: post #127

Earlier quoted context omitted.

BitWarden doesn't get "complete access to your digital life", they get an encrypted blob. It's not materially different than storing your KeePass vault in the cloud.

There's still trust there. You're writing the key to decrypt everything into their web interface if you ever use it (vault.bitwarden.com). If they wanted, they could really get access to everything in your bitwarden vault.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

Re: Bitwarden Acquires Passwordless.dev

#214

Post by hn_throwaway_99 »

princevegeta89 wrote: post #189
manmal wrote: post #165

Earlier quoted context omitted.

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

Same was said about LastPass many times and look at what happened, everything turns out to be a false promise.

That's not a fair comparison. The differences in LP and 1P encryption approaches have been well known for years, and they are fundamentally different.

Now, while 1P encrypted vaults are not brute-forceable the way LP's are, that doesn't mean it's impossible to hack 1P (e.g. malicious code injection in any of their apps or plugins), but I don't like the "everything turns out to be a false promise" broad-brushing when there are real and verifiable differences in how these companies secure your data.

Re: Bitwarden Acquires Passwordless.dev

#215

Post by 9dev »

qzx_pierri wrote: post #27
ohCh6zos wrote: post #12

I’m highly skeptical of Passkeys/Webauthn as it would seem to not have the same legal protections that a password has in the US. Maybe this is me becoming a conspiracy theorist.

I’m in the same boat. Using Passkeys gives the user less control. The last thing I need is another layer of complexity when dealing with credentials. This seems like a solution created for people too lazy to generate and track secure secrets (using a password manager). It also seems like a way companies like Google would lock people into their browser.

Well, passkeys come with another very interesting property: they make it entirely useless to obtain the database of user credentials from services. It only contains public keys specific to a single service, so you cannot use them anywhere else. Additionally, private keys are stored on secure storage in client devices (or need to be decrypted themselves using a second factor), so there’s pretty much 0% risk of mass credential leakage.

Re: Bitwarden Acquires Passwordless.dev

#216

Post by mbesto »

hn_throwaway_99 wrote: post #191
mbesto wrote: post #134

Earlier quoted context omitted.

> VC funds and acquisitions are rarely good for users Where does this sentiment come from? I know very few applications I use that are VC funded or haven't gone through acquisitions...

The issue is that there are a large number of products/companies (I think the vast, vast majority) whose addressable market size isn't that big, but when they take VC money they do all types of unnatural things to try to grow instead of focusing on the couple things they were really good at. Couple cases in point: 1. Totally agree with the comments that VC funding absolutely killed LastPass. 2. Twitter is probably an…

Ya, but can you name any products where this is the opposite? Meaning, how many products do you use that aren't VC backed?

Re: Bitwarden Acquires Passwordless.dev

#218

Post by notpushkin »

jjeaff wrote: post #175
CuriousCosmic wrote: post #80

Earlier quoted context omitted.

To add onto this, if you care about supply chain attacks, bitwarden mobile supports Fdroid builds (albeit not part of the main repo because they rely on xamarin) so you can host your own fdroid repo and run your own builds if so desired.

If you are making your own build, is there a benefit to using f-droid? Why not just install the APK?

Update notifications?

Re: Bitwarden Acquires Passwordless.dev

#219

Post by sakopov »

anonkogudhyfhhf wrote: post #96
sakopov wrote: post #72

Earlier quoted context omitted.

Agreed. I use keepass + dropbox secured with yubikey. You can even go a step further and configure yubikey with keepass as well.

Where about on mobile?

I believe KeepPassDX on android supports yubikey via NFC.

Re: Bitwarden Acquires Passwordless.dev

#220

Post by dcow »

stavros wrote: post #205
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

I kind of want to point out the discrepancy in saying "I get syncing without sharing my data with anyone by sending my password database to Apple". If your argument is that the database is encrypted, how is Bitwarden different?

What this highlights in my humble opinion is that many users seek security signals and are less concerned with the actual security implementation. In the password management space, the signals are "local vault", and "not VC backed", at least on HN. It's quite odd since you'd think people would be more concerned with the application architecture, key derivation, key transport backup and recovery, etc. But it seems security is more synonymous with "company doesn't store my vault on their servers" than it is with "company helps me securely encrypt my passwords".
Post reply on HN