Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

291–300 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#291

Post by seabrookmx »

psd1 wrote: post #212
techwizrd wrote: post #122

Earlier quoted context omitted.

I'm glad that Bitwarden moved quickly to resolve this. At least for me, Firefox's password manager isn't really a replacement. Bitwarden is approved by my employer, self-hostable, and supports logins for the litany of apps across my browsers and mobile devices. Whether it's the mobile app, mobile website, or site in my browser, Bitwarden just works for the most part. It's also quite nice that Bitwarden can store arbi…

It's more than self-hostable! There's at least one API-compatible alternative (vaultwarden) which works with the official client. Yay to breaking down walls.

Vaultwarden is great! I've been running it for years (since it was bitwarden-rs) on a free-tier GCP VM. I use a cronjob to back up the DB to Backblaze B2 with rclone.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#292

Post by WD-42 »

creesch wrote: post #248
ryukafalz wrote: post #230

Earlier quoted context omitted.

Yeah, likewise. I'm a Bitwarden subscriber but I'd been looking into alternatives recently because of the licensing kerfuffle. But switching password managers is a pain, so I'm glad to not feel like I have to now.

Are there other alternatives that are 1) open source 2) offer the same integration to begin with and finally 3) have been audited or are popular enough to be under constant scrutiny? There is of course the KeePass ecosystem, but that is why I included my second point, as with KeePass you are responsible for vault syncing, having clients for all platforms, etc. I suppose that it is good to be aware of other options. A…

https://www.passwordstore.org/

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#293

Post by seabrookmx »

slightwinder wrote: post #223
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

> I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good I wouldn't say it's good, but it does its job, if you can live with the insecurity and limitations. It's very comfortable, which is the only reason I'm still using it over KeePass and Bitwarden. KeepPass has no reliable Browser-integration, and Bitwarden is hard to selfhost. Firefox Passwordmanager is just…

Have you tried vaultwarden (formerly bitwarden-rs)?

It's trivial to self host. I've been running it in a GCP free tier VM for years.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#294

Post by hedora »

creesch wrote: post #248
ryukafalz wrote: post #230

Earlier quoted context omitted.

Yeah, likewise. I'm a Bitwarden subscriber but I'd been looking into alternatives recently because of the licensing kerfuffle. But switching password managers is a pain, so I'm glad to not feel like I have to now.

Are there other alternatives that are 1) open source 2) offer the same integration to begin with and finally 3) have been audited or are popular enough to be under constant scrutiny? There is of course the KeePass ecosystem, but that is why I included my second point, as with KeePass you are responsible for vault syncing, having clients for all platforms, etc. I suppose that it is good to be aware of other options. A…

I decided that vaultwarden should not have an internet accessible port. Are there any that meet those requirements and also let you (reliably!) edit/create passwords when offline?

Also, sometimes the bitwarden client decides to blow away my local copy of the password database. I'd like it to store it pesistently on all machines so I have to lose my phone, my laptop, my vaultwarden server and its two backups before I get locked out of everything.

Currently, the phone + laptop don't count as backup copies.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#296

Post by sublimefire »

gregwebs wrote: post #151
freeone3000 wrote: post #47

Earlier quoted context omitted.

I store the password vault in dropbox. Done.

I did this a long time ago but eventually ended up with conflicts. Password managers write new entries in a file and easily avoid conflicts whereas agnostic file managers will immediately conflict if sync wasn’t working for a while on a device

I use it (Keepass) for a while and never got the conflict on the desktop client (osx), nor on Firefox. But the iOS app does not like the file on the Google Drive and occasionally it needs to be reloaded.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#297

Post by sublimefire »

gertop wrote: post #36
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

Firefox's password manager stores passwords in clear text unless you use a master password (very few people do). This means that any process on the computer can read them. It also means that, unless you also use full disk encryption, a stolen device means you're fucked. Chrome and Safari use the OS's keychain at least, so there is some level of security. And a standalone password manager has its own encryption.

Browser password managers and their related files are the usual targets of the sophisticated malware creators. Not many people use good master passwords either if any.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#298

Post by lrem »

usrusr wrote: post #162
lrem wrote: post #134

Earlier quoted context omitted.

All serious browser vendors offer sync to logged in users. That’s multi-device, cross platform and pretty foolproof. I still prefer Bitwarden because of self-hosting and integrating nicely with the iOS ecosystem. But there’s not much wrong with the browser approach.

Multi device is all nice and well, but what if you use products from more than one browser vendor?

Then you’re a rare corner case that’s served by something third party.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#299

Post by sigzero »

bigfatfrock wrote: post #25
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

> because KeepassXC + syncing is way too difficult for normal people I've been debating for ages if this is a hurdle that can be overcome by packaging or even hand-holding support. When I show "normal people" my pass+sync setup they beg me to implement it for them. Once it's running it's near-zero maintenance.

KeepassXC also doesn't have templates for things. It's in the works. When it comes out I might take another look at it.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#300

Post by sublimefire »

threatofrain wrote: post #5

GPLv3 is interesting because it means to use their code in a commercial setting, then you must also have the guts to open source too.

The context is inaccurate because it is actually dual licensed so thinking about GPLv3 alone is not painting the whole picture.

> The default license throughout the repository is your choice of GPL v3.0 OR BITWARDEN SOFTWARE DEVELOPMENT KIT LICENSE unless the header specifies another license. Anything contained within a directory named bitwarden_license is covered solely by the BITWARDEN SOFTWARE DEVELOPMENT KIT LICENSE.

Post reply on HN