Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

281–290 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#281

Post by szundi »

kjfarm wrote: post #48
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

A good note for bitwarden is that it has a self hosting open source version, vaultwarden that is easy to switch to: https://github.com/dani-garcia/vaultwarden I see this as downside protection, as I can quickly migrate if I disagree with bitwarden's direction with minimal changes to my clients. I do worry about VC pressure on Bitwarden for hypergrowth. However in my personal opinion, the benefits outweigh the cons (f…

If dev support from the company fades, the UI will start to deteriorate - and wether you are hosting or not, that is also a thing that matters. Like mobile apps, browser plugins, form filling logics and specific site behaviours etc.

Re: Bitwarden Acquires Passwordless.dev

#282

Post by secabeen »

WorldMaker wrote: post #278
secabeen wrote: post #270

Earlier quoted context omitted.

> It should start to happen automatically. Apple, Google, and Microsoft have all stated the goal that they are hoping for deep inter-operation across all of a user's devices, regardless of ecosystem. If this is the case, then maybe there will be some solution through Google Takeout. Apple and MS seem less interested in this, but if one of them can generate an export, I can see services appearing that can work with th…

> If this is the case, then maybe there will be some solution through Google Takeout. Apple and MS seem less interested in this, but if one of them can generate an export, I can see services appearing that can work with that exported data. So far as I'm aware none of them are planning key exports any time soon. Keeping keys to the various secure enclaves of user's devices is a key part of the security footprint they…

This is an unrelated question, so I'm putting it in a different thread.

How will Passkeys work for users who don't have or want a smartphone? There are plenty of people who carry no electronic devices on their person, and who primarily access the Internet through library access stations, other public Internet services. or multiple desktops. Will they be unable to use a site that is passkey-auth-only until they get such a device?

Re: Bitwarden Acquires Passwordless.dev

#283

Post by _8j50 »

PassageNick wrote: post #126
_8j50 wrote: post #111

Passwordless as a concept needs to die along with biometric auth. You have really good newer methods of auth. Instead of selling them as good MFA alternatives security vendors decided to replace passwords because that differentiates them more. But in reality, the layer of defense "what you know" should be complemented not replaced. A reduction in security being sold as a feature is dishonest and harmful.

The threat surface of a password based system is like Lake Superior. The threat surface of a passkey based solution is like a small puddle after a rain. How is there a "reduction" in security here?

Doesn't work that way. Passwords are inferior but still a strong layer of defense. You are putting all your eggs in one basket again. The lesson from passwords is that a single factor of authentication is inherently inferior to multiple factors of authentication. From a threat actor's perspective, even a yubikey is a matter of one well planned attack (physical, compromised host,etc) and by nature newer factors of auth don't get treated with hostility like with passwords. They are better than passwords but what I see is people moving away from MFA to only a yubikey for example. Like you are now one lost yubikey away from your whole company getting owned lol.

Re: Bitwarden Acquires Passwordless.dev

#284

Post by franga2000 »

vanilla_nut wrote: post #276
dcow wrote: post #231

Earlier quoted context omitted.

In your opinion, what would the ideal password management business model be? A non-profit like Signal? (Not rhetorical, actually curious what people want here.) As a thought experiment, let's say there are 1000 people who get annoyed when a software product they use takes VC funding. For those 1000 people to sustain a software product with a team of 5 for 10 years at 150k average per head. you'd need 7.5MM dollars ju…

Non-profit like Signal that sells cloud hosting to pay the bills, standard protocol with self-hosting option for the server like email/browsers agreed upon decades ago, anyone can create an interoperable desktop/browser/mobile client. Fully encrypted such that even the non-profit doesn't have the decryption keys. That being said: it's unclear if anyone really understands how to build an open source product with cloud…

> sells cloud hosting to pay the bills, standard protocol with self-hosting option for the server like email/browsers agreed upon decades ago, anyone can create an interoperable desktop/browser/mobile client. Fully encrypted such that even the non-profit doesn't have the decryption keys

All of those are true of Bitwarden, except for the non-profit part...

> Or you could charge individual users $5 a year to cover cloud costs

And who pays for the development?? Bitwarden already charges only 10€/year, so they're basically doing exactly what you're proposing, but paying for development with VC money.

Even if servers were literally free (they're far from it!), do you have any idea how many users they'd need to cover just the minimal amount of developers, one business person and either an in-house or external security auditor? And who would pay for all of that during the time it took them to build up that user base??

I hate the VC culture as much as the next guy, but unless the founder is already crazy rich, you need external capital to start up any large decently company - or even a non-profit.

Re: Bitwarden Acquires Passwordless.dev

#285

Post by brandon272 »

hn_throwaway_99 wrote: post #272
brandon272 wrote: post #260

Earlier quoted context omitted.

1Password's client side encryption is occurring within it's proprietary, closed-source product, so I'm not sure how the end to end process can be completely validated. With respect to your confidence in 1Password's code and encryption methodology, would you be willing to send me your 1Password vault so that I can have a look at it?

> 1Password's client side encryption is occurring within it's proprietary, closed-source product It's Javascript running in a browser. > With respect to your confidence in 1Password's code and encryption methodology, would you be willing to send me your 1Password vault so that I can have a look at it? Yes, absolutely (note I don't actually know how to get the encrypted version of the vault standalone). Are you willin…

> Yes, absolutely (note I don't actually know how to get the encrypted version of the vault standalone).

I believe that, given that it's just JavaScript in the browser, that the encrypted vault should be available as a blob in one of the network requests when you are making a change to the vault.

> Are you willing to send banking information over HTTPS? It's the same level of security.

Maybe I'm being irrational, but I just think there is a fundamental difference in the risk profile between a breach of my banking credentials and having every stored set of credentials across my entire digital life exposed through a password vault breach.

If my banking details were compromised somehow, I at least have a bank I can work with and real people I can talk to. Both the bank and myself have a strong mutual interest in addressing the acute security issue. Government banking regulations come into play. Insurance comes into play.

If my password vault is compromised and credentials for every service and website are exposed, I would argue that is a far graver matter. And who do I turn to in that case? I have to imagine that any of these password management companies would just point to me being somehow negligent with my master key and tell me to pound sound.

Re: Bitwarden Acquires Passwordless.dev

#286

Post by 9dev »

secabeen wrote: post #251
9dev wrote: post #215

Earlier quoted context omitted.

Well, passkeys come with another very interesting property: they make it entirely useless to obtain the database of user credentials from services. It only contains public keys specific to a single service, so you cannot use them anywhere else. Additionally, private keys are stored on secure storage in client devices (or need to be decrypted themselves using a second factor), so there’s pretty much 0% risk of mass cr…

> they make it entirely useless to obtain the database of user credentials from services. It only contains public keys specific to a single service, so you cannot use them anywhere else. This is also the case for anyone using unique passwords per site, which is the standard for password vault users. Not much of a win there. > Additionally, private keys are stored on secure storage in client devices (or need to be dec…

No, you misunderstood me. Passkeys remove the incentive to attack auth infrastructure in the first place, because a database of WebAuthn credentials isn’t useful to criminals compared to a database full of password hashes. This isn’t about the handful of tech-savvy users who know how to protect their privacy anyway, but all the others which constantly reuse their insecure passwords and won’t use password managers.

Re: Bitwarden Acquires Passwordless.dev

#287

Post by roustem »

afavour wrote: post #239
roustem wrote: post #188

Earlier quoted context omitted.

1Password certainly added a ton of new features recently :) Did you check 1Password developer tools, like SSH-agent server, git commit signing, and CLI? https://developer.1password.com/ Or the new item and file sharing. https://support.1password.com/share-items/

I have no interest in those things, they're good examples of what I don't want in my password manager. Sorry, I don't mean to sound like an ass, they look like very well put together features. They just remind me of when Dropbox decided to start offering document editing. Not what I go there for.

Fair enough, everyone has their own requirements. I'd argue that all modern operating systems have password management already built-in.

We have a lot of 1Password customers with families and team members that require more than a single vault, need an option to recover team/family member access and often have to securely share data with other people, accountants and lawyers. Also, many of developers and admins that want to keep their SSH keys safe.

Re: Bitwarden Acquires Passwordless.dev

#288

Post by getcrunk »

dcow wrote: post #244
Kimcha wrote: post #237

Earlier quoted context omitted.

Not if you are using their cloud version instead of the open source self hosted server. The code they are running does have to be the code they are publishing. And if someone compromises their cloud servers, they could also modify it to log the passwords entered.

Yes we can degenerate into inordinate amounts of rabbit holes. For 1, you can audit the JS that runs on your browser, it's not hiding (so it's not strictly fair to say that just because you loaded a webpage in your browser from their server it can't be trusted). And anyway, generally, your argument holds for any software interaction ever. GH doesn't have to ship you the repo that you browsed on the web client. A mali…

Well even then you have to make sure your compiler isn’t playing tricks on you. So compile your compiler from source … oh wait. Then you have your cpu microcode, firmware, security coprocessors.

Trusting trust

Re: Bitwarden Acquires Passwordless.dev

#289

Post by Y_Y »

aaronax wrote: post #277
Y_Y wrote: post #201

Earlier quoted context omitted.

I haven't seen, but would love to, a tech startup that is guaranteed not to sell out. I don't mean a promise from the founder on a blog, but a legal structure. I'm not sure what what form this would take or if it's such anathema that it could never be but it would be great to see. I'm sure I'm not the only one who's tired of the bait-amd-switch of companies who are all about freedom until they get acquired by a giant…

Cooperative Customers are members/owners. Examples: Tessitura, NISC

Someone posted this list of such co-ops recently: https://tech-coops.xyz/

Is it true that they couldn't sell out though? I imagine if the buyer offered a pile of money then the majority of the owner-workers would go for it, even at the expense of the users.

Re: Bitwarden Acquires Passwordless.dev

#290

Post by WorldMaker »

secabeen wrote: post #282
WorldMaker wrote: post #278

Earlier quoted context omitted.

> If this is the case, then maybe there will be some solution through Google Takeout. Apple and MS seem less interested in this, but if one of them can generate an export, I can see services appearing that can work with that exported data. So far as I'm aware none of them are planning key exports any time soon. Keeping keys to the various secure enclaves of user's devices is a key part of the security footprint they…

This is an unrelated question, so I'm putting it in a different thread. How will Passkeys work for users who don't have or want a smartphone? There are plenty of people who carry no electronic devices on their person, and who primarily access the Internet through library access stations, other public Internet services. or multiple desktops. Will they be unable to use a site that is passkey-auth-only until they get su…

Very good questions and I've been wondering that some myself. I imagine of the Big 3 Microsoft is likely the one to have been thinking about this the most. With Microsoft no longer having a smartphone ecosystem of their own, they will likely have to support both Apple and Android devices and they probably also need to have more answers for the "neither" scenarios as well (de-Googled Android users still sometimes have Windows PCs, for instance; Windows users are said to include a larger share of older "dumb phone" generations; etc). Also, most of those access stations themselves are generally Windows PCs for the intersection of cheapest available hardware and lowest common denominator software. (Though I've heard Chrome OS is shifting that in some places.)

I think the immediate answer is that something like a Microsoft Account-based login system and Cloud-based key escrow becomes more unavoidable in situations like that. But I'm not sure and hopefully there are smart minds exploring some of these scenarios in the long term. Relatedly, I know there are some long-term creatives trying to figure out if "smartphone" is becoming a required utility for the modern world (TOTP has already made that a recently strong requirement in plenty of areas; soon you may not be able to bank without a mobile device, for instance) and the "phoneless" may be its own evolving economic crisis on top of homelessness to deal with in the long term. "Give everyone phones" may sound like a curt, dumb answer, but it may end up being something close to the answer; go to your local DMV and get a secure phone as your digital ID to go with your physical ID. I don't know if that is the plan, I just know it is a plan I've heard we need to consider, that "baseline personal hardware" may be an ever-increasing need.

Post reply on HN