Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

31–40 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#31

Post by danpalmer »

blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

> Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good

Interesting, I've always felt that browser-based password managers provided remarkably little value for most people. Using them on mobile is tricky and platform dependent, it's easy to have local-only, non-synced data and then lose it, and being multi-device is trickier, especially in a work context.

On the other hand, people generally understand installing an app on each device they own and that app doing it for them.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#32

Post by freedomben »

lxgr wrote: post #21
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.

There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled.

I would strongly advise using something like Aegis on Android, or Gnome Authenticator on desktop (or both). I like to duplicate/backup my seeds so that I'm not SOL if my phone breaks, but I do it by having them on my laptop, desktop, and phone. That way as long as I have one of the three devices, I can always get in, and then they're not "in the cloud." Though, "in the cloud" is still better than "in the cloud alongside all my passwords."

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#33

Post by lie07 »

bigfatfrock wrote: post #25
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

> because KeepassXC + syncing is way too difficult for normal people I've been debating for ages if this is a hurdle that can be overcome by packaging or even hand-holding support. When I show "normal people" my pass+sync setup they beg me to implement it for them. Once it's running it's near-zero maintenance.

Would love to know how you have it setup.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#34

Post by Thaxll »

blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

Keepass file on Google drive is kind of trivial though.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#35

Post by freedomben »

ok_dad wrote: post #10

Luckily if they die another will rise up. At this point I’m thinking I’ll just use the Apple Keychain if Bitwarden gets up to no good again.

It probably doesn't matter for you if you'll never be leaving Apple's ecosystem, but for anyone else, I think that's something to keep in mind before moving to a non-portable solution like Apple keychain.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#36

Post by gertop »

blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

Firefox's password manager stores passwords in clear text unless you use a master password (very few people do).

This means that any process on the computer can read them.

It also means that, unless you also use full disk encryption, a stolen device means you're fucked.

Chrome and Safari use the OS's keychain at least, so there is some level of security.

And a standalone password manager has its own encryption.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#37

Post by gertop »

sneak wrote: post #20
MisterKent wrote: post #15

People here are incredibly hard to please. Very clearly a packaging issue that got blown out of proportion. They've done largely the right things for _years_ in terms of security. They've operated pretty transparently in terms of open sourcing. They've allowed vaultwarden to exist, and eventually created a self hostable version as well. But one bad release with a license screw up and nobody is willing to give them an…

For a long time their KDF was bad and the iteration count was low. When I reported it to them they got really hostile and evasive about it. Years later they switched to Argon, somehow solving all of the blocking problems they had repeatedly claimed they couldn’t fix. I don’t trust the org at all. The software is ok but I only use it because it sucks marginally less than all my other options. People who care about sof…

> When I reported it to them they got really hostile

You're not the one who first reported it, but I did see your comments at the time. Calling them hostile is really the pot calling the kettle black, uh?

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#38

Post by mikehotel »

gertop wrote: post #36
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

Firefox's password manager stores passwords in clear text unless you use a master password (very few people do). This means that any process on the computer can read them. It also means that, unless you also use full disk encryption, a stolen device means you're fucked. Chrome and Safari use the OS's keychain at least, so there is some level of security. And a standalone password manager has its own encryption.

This has been the case for a long time, and has not changed even in 2024. Please use a Primary Password if you are storing passwords in Firefox.

https://support.mozilla.org/en-US/kb/where-are-my-logins-sto...

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#39

Post by jgauth »

This update is great news. I was disappointed to see the issue that got raised last week, and I had started to consider looking for alternatives. I’m going to assume an honest mistake on their end and keep recommending their product. However, if they make a similar move again, I will assume the worst and move on.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#40

Post by magackame »

freedomben wrote: post #32
lxgr wrote: post #21

Earlier quoted context omitted.

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.

There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis o…

Doesen't having the seeds available on all of the devices make it not 2FA? You now need only one device to login at any given time.
Post reply on HN