Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

221–230 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#221

Post by slightwinder »

Anunayj wrote: post #183
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

Can someone also comment on how secure the built in password in manager in Firefox is to unsophisticated malware attacks that simply copy your browser extension data and such. Compared to bitwarden which requires a password to unlock it, and as I understand stores everything encrypted on disk.

If you don't use a master password, it's unsafe. And even with master password, I vaguely remember it's not that safe either, but that might be outdated info.

This was going around the last days: https://github.com/Sohimaster/Firefox-Passwords-Decryptor

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#223

Post by slightwinder »

blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

> I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good

I wouldn't say it's good, but it does its job, if you can live with the insecurity and limitations. It's very comfortable, which is the only reason I'm still using it over KeePass and Bitwarden. KeepPass has no reliable Browser-integration, and Bitwarden is hard to selfhost. Firefox Passwordmanager is just there, always works, syncs without hassle, usability at it's peak (for this job).

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#224

Post by lucideer »

freedomben wrote: post #32
lxgr wrote: post #21

Earlier quoted context omitted.

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.

There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis o…

Aegis is no more secure than storing your TOTPs in your password manager - 2 factors primarily protect against remote attacks, which don't have direct access, in which case the app your 2nd factor lives in is moot. If your threat model involves direct access you need dedicated hardware for your 2nd factor. Most people are fine with TOTP in pw manager.

(I do use Aegis as I like the UX but that's a separate topic)

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#225

Post by lucideer »

hsdropout wrote: post #144
saint_yossarian wrote: post #45

Earlier quoted context omitted.

It's still 2 factors though, if someone discovers your password they don't automatically know the TOTP key. So I use TOTP in my password manager for sites where I wouldn't use 2FA otherwise (because using my phone would be inconvenient), so it's still a security improvement for me. And for critical accounts I do use Aegis on my phone.

That's not 2FA, that's two of the same factor. The factors are: - Something you know - Something you have - Something you are (biometrics)

That list makes for a nice slidedeck but the separation (like many things in tech) isn't as clear cut as the metaphor.

"Something you know" (password) becomes "something you have" as soon as you store/autogenerate/rotate those passwords in a manager (which is highly recommended).

"Something you have" in the form of a hw key is still that device generating a key (password) that device/browser APIs convey to the service in the same way as any other password.

"Something you are" is a bit different due to the algorithms used to match biometric IDs but given that matching is less secure than cryptographic hash functions - this factor is only included in the list for convenience reasons.

The breakdown of this metaphor is one of the reasons passkeys are seen as a good thing.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#226

Post by phs318u »

joshvm wrote: post #159
nox101 wrote: post #110

Earlier quoted context omitted.

it just works for websites. it does not "just work" for apps where as the platform ones do or have a chance to work with apps. Kind of hope regulation will force apple/google/ms to allow iterations for 3rd parties to integrate with the os but on the other hand that will open a host of issues

It does on iOS, but I believe the onus is on the app developer to enable the autofill feature in the form, or at least make sure that the app hints to iOS that it can be filled with a password. I'm making that assumption because there are lots of apps which don't trigger the native Apple password manager either (which is a lousy user experience). However, if one works then both do. The UI offers a choice of password…

I use the Strongbox app on iOS [0] and the KeepassXC app my Linux laptop. The passwords.kdbx file sits on my Onedrive, which the Strongbox app can access. On Linux I use a Onedrive client [0] that I use to sync several folders within my home folder. Strongbox supports both Keepass and pwSafe database formats. It also integrates well with iOS, with autofill supported (also supports Yubikey unlock and Apple Watch unlock).

[0] https://apps.apple.com/app/strongbox-password-manager/id8972...

[1] https://abraunegg.github.io/

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#227

Post by kuschku »

hnbad wrote: post #155
Capricorn2481 wrote: post #58

Earlier quoted context omitted.

> BitWarden has lost the trust. Besides... I'm confused what you're responding to. You're making it sound like this was a bad decision and your anecdote was another thing for the pile, but this is a good decision.

Someone else linked the GitHub issue that triggered this change and most of the replies are in the same tone as the comment you're responding to. Which is all the more ridiculous as this looks like it wasn't really a big license change decision but more of a "forgot to change the license on a component from our internal default". Assuming malice seems like the most boneheaded reaction to this given that there are no…

> forgot to change the license on a component from our internal default".

https://gitlab.com/fdroid/fdroiddata/-/merge_requests/15353#...

> Additionally, one thought that came to mind in evaluating this that might make this not possible is that our rust SDK, a dependency, is not published under an OSS license. See https://github.com/bitwarden/sdk . I assume that is a problem that might disqualify us from the main [fdroid] repo still.

https://gitlab.com/fdroid/fdroiddata/-/merge_requests/15353#...

> At the moment, there are no plans to adjust the SDK license.

Doesn't sound like a mistake:

https://github.com/bitwarden/sdk/issues/898#issuecomment-222...

> There are no plans to adjust the SDK license at this time. We will continue to publish to our own F-Droid repo at https://mobileapp.bitwarden.com/fdroid/repo/

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#228

Post by wrasee »

greensh wrote: post #218
wrasee wrote: post #213

Earlier quoted context omitted.

If Mozilla released a separate passwords app so you could manage and access your passwords outside of Firefox I think the two would be more comparable. That would promote your passwords as part of your Mozilla account, not just Firefox. Bitwarden excels here, and i think is the model to beat. However, Mozilla would have the advantage since their browser integration would essentially be built-in and first class. Other…

there used to be an android/ios app by mozilla called lockwise which did exactly that iirc. https://support.mozilla.org/en-US/kb/end-of-support-firefox-...

Ah yes I remember that now, I had forgotten about that!

Funny, especially now that I see Apple are now going the other way with a dedicated "Passwords" app on iOS 18 and macOS 15. And for Apple to do this - against their instinct for featureless simplicity and implicit integration - to give passwords their own "shop front" as a dedicated app I think really does acknowledge the first-class importance that passwords now have, even for a broad audience.

It's a shame as I think Mozilla could really compete well in this space. They are both cross-platform, have their their own browser and have a good reputation on privacy. It's a killer combo. Bitwarden is evidence you can make it work and you don't need massive big-tech budgets to make a difference.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#230

Post by ryukafalz »

itfossil wrote: post #229

Nice to see Bitwarden make a course correction here. I wasn't looking forward to switching to another password manager, so I'm quite happy.

Yeah, likewise. I'm a Bitwarden subscriber but I'd been looking into alternatives recently because of the licensing kerfuffle. But switching password managers is a pain, so I'm glad to not feel like I have to now.
Post reply on HN