Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

221–230 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#221

Post by karaterobot »

ok_dad wrote: post #148
sph wrote: post #53

Earlier quoted context omitted.

Ah for fuck's sake. It keeps happening to all the software I love. I guess I'll have to stop relying on convenience (I was a 1Password user years ago) and go 100% open-source. None of the libre offerings seem to be as convenient and polished, but at least they're not into some VC's pocket ready to squeeze as much profit as possible out of my paid membership. What's a good OSS alternative that works with iOS and Linux…

> Ah for fuck's sake. I agree, and I wish we had more power in these things than just forking. Now that I know Bitwarden took VC money, I'm also fucking out of this mess, and here I was about to renew for the 5th year in a row. Fuck VC's, they ruin everything good. Can I say that here? It's true.

You can definitely say that here. To me the problem isn't exactly VCs, it's the expectation of rapid, open-ended growth that ruins good products and companies. Of course, the driver for that is often VCs, but it can come from other places too.

Re: Bitwarden Acquires Passwordless.dev

#222

Post by chriscjcj »

moogly wrote: post #135
chriscjcj wrote: post #98

Earlier quoted context omitted.

I self-host Vaultwarden. I'm sure someone will be happy to explain to me how foolish my implementation is, but I'm comfortable with it from a security perspective. I run it as a Docker instance on my home Synology NAS. This turned out to be pretty easy to do. The only part that was a slight hassle was buying a cert, creating an FQDN and making the DNS entries to get an SSL connection to the NAS. Also, I wish updating…

> The only part that was a slight hassle was buying a cert, creating an FQDN and making the DNS entries to get an SSL connection to the NAS Note that Synology DSM has built-in Let's Encrypt support

> Note that Synology DSM has built-in Let's Encrypt support

Yes... I tried going down that route. In my scenario, I'm accessing the NAS via its internal IP which is in an RFC1918 subnet. Let's Encrypt insists that you use a globally routable IP. If I used the public IP issed to me by my ISP, then I would have to map a port on my router and expose the NAS directly to the Internet. No way am I doing that.

I bought a cert through Namecheap and got 5 years for $29.95. That seemed quite reasonable to me. There was no problem getting it to work when I mapped the hostname to the NAS's internal IP. The only downside is that I have to go through a renewal process every year and install the updated cert on NAS. Not a huge deal; just one more thing I have to do.

Re: Bitwarden Acquires Passwordless.dev

#223

Post by hn_throwaway_99 »

mbesto wrote: post #216
hn_throwaway_99 wrote: post #191

Earlier quoted context omitted.

The issue is that there are a large number of products/companies (I think the vast, vast majority) whose addressable market size isn't that big, but when they take VC money they do all types of unnatural things to try to grow instead of focusing on the couple things they were really good at. Couple cases in point: 1. Totally agree with the comments that VC funding absolutely killed LastPass. 2. Twitter is probably an…

Ya, but can you name any products where this is the opposite? Meaning, how many products do you use that aren't VC backed?

craigslist famously rejected taking outside money for years.

But more importantly, I don't think VC or VC money is always bad, but I get extremely wary when a relatively small company gets a shitload of money that they'll then be forced to grow into a way that means they'll lose focus on their core product.

I remember when I told a friend of mine that Postman raised nearly half a billion dollars in total funding, and his jaw dropped "You mean that browser plugin that allows you to make REST calls???" And sure enough, postman got filled with more and more "enterprise-y uselessness" to the point that I just stopped using it.

Re: Bitwarden Acquires Passwordless.dev

#224

Post by WorldMaker »

heresjohnny wrote: post #101

Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?

Just like TOTP (used for most 2FA) the best practice for websites accepting passkeys will be to support as many passkeys as you wish to enroll. So you could enroll into your account some device associated with your Apple ID and some device associated with your Microsoft Account and some device associated with your Google Account and some browser associated with your Firefox Account and use any of those for recovery.

Unlike TOTP, the base case for passkeys is multiple key enrollment so websites are more likely to support it well whereas with TOTP so many implement it as having one-and-only-one TOTP configured. Even when enrolling just a single device that device generally enrolls a small key-chain, not just a single key, because that's how recovery systems work even for using just a single "owner" account. Plus most people use 2 or more devices regularly and Passkey has to work with that. So much more websites in practice should actually support N passkeys where N > 1 (versus half-baked single-option-only TOTP implementations).

At least in theory, in practice we'll see how well Passkey gets implemented at large, there's always lots of ways for companies to get practice wrong.

Re: Bitwarden Acquires Passwordless.dev

#225

Post by DavideNL »

manmal wrote: post #165
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

Note that 1Password copies the "Secret Key" to iCloud... without asking.

Re: Bitwarden Acquires Passwordless.dev

#226

Post by cmdli »

Ajedi32 wrote: post #203

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023. That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. I'm hopeful Bitwarden will solve that problem, and that their example wi…

Shameless plug to my own passkey manager, which is 100% open source: https://bulwark.id

One of the big challenges to passkeys right now is that they aren’t as versatile as passwords, but this doesn’t have to be the case. Passkeys should be able to be exported and stored anywhere you want (ideally in an open source solution). Bulwark Passkey supports that right now, but I’m glad that other products are also providing solutions to users for the same problem.

Re: Bitwarden Acquires Passwordless.dev

#227

Post by jmcphers »

kdmccormick wrote: post #157
sph wrote: post #53

Earlier quoted context omitted.

Ah for fuck's sake. It keeps happening to all the software I love. I guess I'll have to stop relying on convenience (I was a 1Password user years ago) and go 100% open-source. None of the libre offerings seem to be as convenient and polished, but at least they're not into some VC's pocket ready to squeeze as much profit as possible out of my paid membership. What's a good OSS alternative that works with iOS and Linux…

If a simple git-based CLI solution is appealing to you, then try https://www.passwordstore.org/ . I wouldn't recommend it someone non-technical, but personally, I've never looked back. There are iOS and Android clients, too. Not especially polished, but they do the job.

Love passwordstore, been using it for almost 6 years with zero issues while watching my friends run frantically from one compromised or greedy password manager to another.

Re: Bitwarden Acquires Passwordless.dev

#228

Post by chriscjcj »

sampling wrote: post #130
chriscjcj wrote: post #98

Earlier quoted context omitted.

I self-host Vaultwarden. I'm sure someone will be happy to explain to me how foolish my implementation is, but I'm comfortable with it from a security perspective. I run it as a Docker instance on my home Synology NAS. This turned out to be pretty easy to do. The only part that was a slight hassle was buying a cert, creating an FQDN and making the DNS entries to get an SSL connection to the NAS. Also, I wish updating…

I have a very similar self-hosted Vaultwarden set up, for the same reasons. My other concern, which may be unfounded is that Vaultwarden [1], which is an unofficial Rust rewrite, may also be developed to different, or lesser security standards than the official client. However I don't have any real reasons to suspect this. [1] https://github.com/dani-garcia/vaultwarden

Agreed. I know I'm taking it on faith that this implementation is robust and secure when it might not be. However, I feel okay about it knowing that it would be very difficult for anyone other than me to access this Docker instance in the first place. And if I'm outside my home network, I'm interacting with it via the VPN.

Re: Bitwarden Acquires Passwordless.dev

#229

Post by sngz »

bluSCALE4 wrote: post #110
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

The concern with Bitwarden started a few months back when they did a round of venture capital funding. Now, they have to turn profits instead of just being great.

not just turn profit. But ridiculous unsustainable amounts of profit at the expense of the users until its bled dry then it will be sold off

Re: Bitwarden Acquires Passwordless.dev

#230

Post by secabeen »

tapland wrote: post #76
yshavit wrote: post #73

Earlier quoted context omitted.

Ideally I'd want to keep my _personal_ personal stuff separate from my "work personal" (ie my personal logins, but the one for work accounts) separate from my shared work stuff. So I'd want two accounts, one for my truly personal accounts, and then one for my work-personal and have the work-shared connected to that.

There doesn't seem to be a security benefit of doing this if you encounter having to swap between personal-personal and work-personal. It doesn't take me many seconds to swap accounts. LastPass allows you to be signed into two accounts at the same time in the same browser?

Lastpass allows you to link your personal-personal account into your work account, so that you can access your personal-personal data while logged into a work account. Work-personal accounts should be stored in a personal folder in your work account, then work-work accounts are in shared folders that cross multiple users.
Post reply on HN