Live data from Hacker News

Bitwarden: Avoid at all costs (outage issue)

news.ycombinator.com

31–40 of 137 posts

Re: Bitwarden: Avoid at all costs (outage issue)

#32

Earlier quoted context omitted.

Another options is pass [0], which uses GPG to encrypt your stuff. Everything happens through the CLI but there are also GUI frontends for it. There's also gopass [1] which is very similar and compatible but does some extra stuff such as versioning with git. Similarly to this API compatibility there's KeePassDX [2] for mobile phones which is compatible with the KeePass database format. There's also KeePass [3] which…

I sync my database to my Android phone with Nextcloud, works great with KeePassDX

Nextcloud is amazing, I just don't have the resources or time to self host right now so I'm currently not using it. Big problem for me is that most cloud providers don't actually support syncing to the filesystem through Android's Storage Access Framework and instead keep all of the data in the app data, requiring me to manually export from the cloud application, and re-import into the password manager.

Re: Bitwarden: Avoid at all costs (outage issue)

#33
They don't disable it remotely but their apps and browser plugins will log you out and destroy local copy (experienced the same when my vaultwarden instance didn't return a response it liked due to MySQL breaking)

Annoying, but I think I see the benefit (kill it if it might be tampered with etc)

Re: Bitwarden: Avoid at all costs (outage issue)

#34

> remotely disable your browser extension which is assumed to work in offline mode This seems incorrect. I experienced this issue while I was working on 1 computer which I infrequently use so I was logged out of BitWarden. Trying to login gave me that oblique error message. I was on a conference call (and presenting of course) so I needed the password Right Now so I pulled out my laptop, which was still logged in, an…

It sounds as if you only were able to access the password because you had a second device that happened to already be logged in. My guess is that if BW's login servers were having a temporary outage, had you not been logged in you wouldn't have been able to login and therefore been unable to get the passwords.

Re: Bitwarden: Avoid at all costs (outage issue)

#36
Lots of people are mentioning that you can host these types of things yourself, I want to say that that is not a solution at all.

The entire point of these hosted password services is that they are a turnkey solution - I could give them to my mom, who knows nothing about technology, and trust that they work. I like using a turnkey solution myself even though I could self-host because I don't want to spend brain cycles on solving the "syncing passwords across multiple devices" issue.

I don't quite understand why Bitwarden even needs to have you login in order to access the passwords. Surely you could just have the salted+hashed passwords on device, and Bitwarden just syncs that data from device to device. If you work in an organization and need to revoke access, just change the password. No need to manage whether or not someone is logged in to Bitwarden.

Re: Bitwarden: Avoid at all costs (outage issue)

#37

Lots of people are mentioning that you can host these types of things yourself, I want to say that that is not a solution at all. The entire point of these hosted password services is that they are a turnkey solution - I could give them to my mom, who knows nothing about technology, and trust that they work. I like using a turnkey solution myself even though I could self-host because I don't want to spend brain cycle…

Also re: the comparisons to AWS or Google Cloud - it's still totally different. This is more like your car being unable to start because it can't connect to the cloud. I don't expect that driving my car needs internet access, and I wouldn't expect Bitwarden needs internet access to serve me my passwords that have already been synced.

Re: Bitwarden: Avoid at all costs (outage issue)

#38

Enpass - Local-first so you own your data - Open about technical documentation and assisted in providing encryption scheme info to an open-source vault reader (so you own your data...) https://github.com/hazcod/enpass-cli - Works with lots of cloud/sync providers - Cross-platform (Windows, macOS, Linux, iOS, Android) - Browser integration (Safari, Firefox, Chrome, Edge, Opera, Vivaldi) - Lifetime license for $79.99

Wow, okay, yeah, I'm actually sold. There's a CLI for desktop, and it's on both ios and android. Damn. Will gleefully fork over $80 for a lifetime license if it's as good as it seems.

Why have I never heard of Enpass before? Anyone have any reason to not switch from Bitwarden to Enpass right now?

Re: Bitwarden: Avoid at all costs (outage issue)

#39

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

Another options is pass [0], which uses GPG to encrypt your stuff. Everything happens through the CLI but there are also GUI frontends for it. There's also gopass [1] which is very similar and compatible but does some extra stuff such as versioning with git. Similarly to this API compatibility there's KeePassDX [2] for mobile phones which is compatible with the KeePass database format. There's also KeePass [3] which…

Not a solution. My passwords database needs to work seamlessly on my laptops and phones so I only use KeepassXC and KeepassDX synced with Syncthing. Free and super effective. I don't have to do any manual work for everything to be in sync always.

Re: Bitwarden: Avoid at all costs (outage issue)

#40

Enpass - Local-first so you own your data - Open about technical documentation and assisted in providing encryption scheme info to an open-source vault reader (so you own your data...) https://github.com/hazcod/enpass-cli - Works with lots of cloud/sync providers - Cross-platform (Windows, macOS, Linux, iOS, Android) - Browser integration (Safari, Firefox, Chrome, Edge, Opera, Vivaldi) - Lifetime license for $79.99

Wow, okay, yeah, I'm actually sold. There's a CLI for desktop, and it's on both ios and android. Damn. Will gleefully fork over $80 for a lifetime license if it's as good as it seems. Why have I never heard of Enpass before? Anyone have any reason to not switch from Bitwarden to Enpass right now?

It is closed sourced and I am not sure that the code base was audited.
Post reply on HN