Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

231–240 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#231

Post by dcow »

sph wrote: post #53
gagabity wrote: post #13

Earlier quoted context omitted.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

Ah for fuck's sake. It keeps happening to all the software I love. I guess I'll have to stop relying on convenience (I was a 1Password user years ago) and go 100% open-source. None of the libre offerings seem to be as convenient and polished, but at least they're not into some VC's pocket ready to squeeze as much profit as possible out of my paid membership. What's a good OSS alternative that works with iOS and Linux…

In your opinion, what would the ideal password management business model be? A non-profit like Signal? (Not rhetorical, actually curious what people want here.)

As a thought experiment, let's say there are 1000 people who get annoyed when a software product they use takes VC funding. For those 1000 people to sustain a software product with a team of 5 for 10 years at 150k average per head. you'd need 7.5MM dollars just to break even. That's $7,500 per user, or $750 per year. I doubt many people would be willing to pay that just to have a product that never takes VC funding.

And note that's just to cover labor costs. If you want it audited, that's a solid 25k per audit. Operating costs for website and infrastructure, etc. Now if the product was exceptional and beat out other products in the space and generally had a slice of the pie, the number of users would increase and per user cost would decrease. But also doing as much with a team of 5 is no small feat.

Re: Bitwarden Acquires Passwordless.dev

#232

Post by crossroadsguy »

sph wrote: post #53
gagabity wrote: post #13

Earlier quoted context omitted.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

Ah for fuck's sake. It keeps happening to all the software I love. I guess I'll have to stop relying on convenience (I was a 1Password user years ago) and go 100% open-source. None of the libre offerings seem to be as convenient and polished, but at least they're not into some VC's pocket ready to squeeze as much profit as possible out of my paid membership. What's a good OSS alternative that works with iOS and Linux…

I have accepted that one has to keep moving around. Password manager, backup software, it goes on.

Right now I am hunting for a non-subscription note taking setup that will replace SimpleNote.

So I’ll move to the next option from BW, just like I moved to it from LP.

Re: Bitwarden Acquires Passwordless.dev

#233

Post by phonebucket »

manmal wrote: post #165
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

But in the context of a strong master password, the additional benefit of the secret key is of neglible benefit, while the hassle and dangers of having to synchronise the secret key remain.

I'd rather use an extremely high entropy master password by itself.

Re: Bitwarden Acquires Passwordless.dev

#234

Post by WorldMaker »

antihero wrote: post #55
Jsharm wrote: post #10

Wow this is really cool. I just tried the example on the homepage, that's magic! No email, username or password. Can someone explain what is happening?

On iOS this seems to use the iCloud Keychain which is slick but how would I then login to sites using Firefox or any computer that doesn’t have access to my keychain? The reason I use a 3rd party manager is precisely this reason.

Sites should likely let you enroll multiple such passkeys from different vendors (add a Microsoft Account passkey from your PC, a Google one from your Chromebook, etc).

Apple already supports Keychain sync with Edge on Windows and I believe that already supports Passkey access.

Also, I believe I heard rumor that "Sign in with Apple" (their existing OpenID Connect account system) will also eventually support helping you enroll non-Apple devices to Passkeys in apps that support both Passkeys and "Sign in with Apple", though I don't know if there is yet a timeframe on that sort of support.

Re: Bitwarden Acquires Passwordless.dev

#235

Post by moogly »

chriscjcj wrote: post #222
moogly wrote: post #135

Earlier quoted context omitted.

> The only part that was a slight hassle was buying a cert, creating an FQDN and making the DNS entries to get an SSL connection to the NAS Note that Synology DSM has built-in Let's Encrypt support

> Note that Synology DSM has built-in Let's Encrypt support Yes... I tried going down that route. In my scenario, I'm accessing the NAS via its internal IP which is in an RFC1918 subnet. Let's Encrypt insists that you use a globally routable IP. If I used the public IP issed to me by my ISP, then I would have to map a port on my router and expose the NAS directly to the Internet. No way am I doing that. I bought a ce…

That all makes sense. Wanted to point out to others that there's potentially less of a hassle to set this up (if you're fine with opening port 80, as has been pointed out to me).

Re: Bitwarden Acquires Passwordless.dev

#236

Post by dcow »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

Seems like Bitwarden is successful enough to have the cash to make a strategic acquisition. That seems like a good thing for users.

Re: Bitwarden Acquires Passwordless.dev

#237

Post by Kimcha »

dcow wrote: post #213
mort96 wrote: post #155

Earlier quoted context omitted.

There's still trust there. You're writing the key to decrypt everything into their web interface if you ever use it (vault.bitwarden.com). If they wanted, they could really get access to everything in your bitwarden vault.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

Not if you are using their cloud version instead of the open source self hosted server.

The code they are running does have to be the code they are publishing.

And if someone compromises their cloud servers, they could also modify it to log the passwords entered.

Re: Bitwarden Acquires Passwordless.dev

#238

Post by miked85 »

roustem wrote: post #188
afavour wrote: post #56

Earlier quoted context omitted.

I did try to switch a year or so ago and got really frustrated. Tried again a week ago and Bitwarden does seem a little better. It helps that it feels like 1Password's app has been getting more bloated over time (though I have no data to support that assertion).

1Password certainly added a ton of new features recently :) Did you check 1Password developer tools, like SSH-agent server, git commit signing, and CLI? https://developer.1password.com/ Or the new item and file sharing. https://support.1password.com/share-items/

I refuse to use a cloud-based password manager, they will all be hacked eventually. I will continue to use and pay for the standalone 1Password as long as possible, and then be forced to self-host vaultwarden.

Re: Bitwarden Acquires Passwordless.dev

#239

Post by afavour »

roustem wrote: post #188
afavour wrote: post #56

Earlier quoted context omitted.

I did try to switch a year or so ago and got really frustrated. Tried again a week ago and Bitwarden does seem a little better. It helps that it feels like 1Password's app has been getting more bloated over time (though I have no data to support that assertion).

1Password certainly added a ton of new features recently :) Did you check 1Password developer tools, like SSH-agent server, git commit signing, and CLI? https://developer.1password.com/ Or the new item and file sharing. https://support.1password.com/share-items/

I have no interest in those things, they're good examples of what I don't want in my password manager.

Sorry, I don't mean to sound like an ass, they look like very well put together features. They just remind me of when Dropbox decided to start offering document editing. Not what I go there for.

Re: Bitwarden Acquires Passwordless.dev

#240

Post by cube00 »

kioleanu wrote: post #94
kjfarm wrote: post #48

Earlier quoted context omitted.

A good note for bitwarden is that it has a self hosting open source version, vaultwarden that is easy to switch to: https://github.com/dani-garcia/vaultwarden I see this as downside protection, as I can quickly migrate if I disagree with bitwarden's direction with minimal changes to my clients. I do worry about VC pressure on Bitwarden for hypergrowth. However in my personal opinion, the benefits outweigh the cons (f…

Note that Vaultwarden is the unofficial server, there is also an official one, that you can self host. Vaultwarden is much easier to set up and manage, I use it myself, and I heard that the official build is a little bit more tedious to go with.

It's easier to manage until it breaks as the recent example last month when Bitwarden updated their client and Vaultwarden had to play catch up and reverse engineer the changes.

That experience sent me back to just letting Bitwarden host for me, I know it's all free and I can't expect anything which is fine, but I can't be without my passwords either.

Post reply on HN