Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

301–310 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#301

Post by brynjolf »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

Honestly since I bought bitwarden premium two years ago, there hasn't been a single relevant improvement to the client. It is basically not getting any UX love.

No autocomplete on username, slow initial load, search function is sticky on desktop client but not on the rest. No way to easily add folders or reorganise multiple items.

I won't renew my subscription, not that they care anymore

Re: Bitwarden Acquires Passwordless.dev

#302

Post by [deleted] »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

[deleted]

Re: Bitwarden Acquires Passwordless.dev

#303

Post by [deleted] »

[deleted] wrote: post #302
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

[deleted]

[deleted]

Re: Bitwarden Acquires Passwordless.dev

#304

Post by palata »

cube00 wrote: post #243
princevegeta89 wrote: post #181

Earlier quoted context omitted.

Is it not possible to point BW Android to your Vaultwarden instance?

It's fragile if you do that. Bitwarden updated their API last month on the clients so you couldn't connect to Vaultwarden at all until the Vaultwarden team could reverse engineer the change and produce a new release.

I'm confused: what do they have to reverse-engineer if it's open source?

Re: Bitwarden Acquires Passwordless.dev

#305

Post by 3np »

mort96 wrote: post #245
dcow wrote: post #213

Earlier quoted context omitted.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

I can't audit their server-side code. Even if it's open source, it's impossible to verify that the software which the server is running is identical to the open source version, or that there's no proxy in between you and the sever which logs the passwords, or some debugger attached which inspects the passwords in memory as people log in.

The proxy would only see encrypted blobs; the client (which afaiui can be compiled and run locally despite using their hosted service) never sees the passwords in clear.

As long as the client and cryptography are uncompromised, the server only gets metadata.

Re: Bitwarden Acquires Passwordless.dev

#306

Post by LelouBil »

mort96 wrote: post #245
dcow wrote: post #213

Earlier quoted context omitted.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

I can't audit their server-side code. Even if it's open source, it's impossible to verify that the software which the server is running is identical to the open source version, or that there's no proxy in between you and the sever which logs the passwords, or some debugger attached which inspects the passwords in memory as people log in.

They have a paper about their architecture.

Basically, your master password is never sent, and everything is encrypted and decrypted locally.

You can't audit the server side code, but you can audit the client (and compile it from source) to make sure that the encryption is local and the master password is not sent.

Re: Bitwarden Acquires Passwordless.dev

#307

Post by LelouBil »

Kimcha wrote: post #237
dcow wrote: post #213

Earlier quoted context omitted.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

Not if you are using their cloud version instead of the open source self hosted server. The code they are running does have to be the code they are publishing. And if someone compromises their cloud servers, they could also modify it to log the passwords entered.

They have a paper about their architecture.

Basically, your master password is never sent, and everything is encrypted and decrypted locally.

You can't audit the server side code, but you can audit the client (and compile it from source) to make sure that the encryption is local and the master password is not sent.

Re: Bitwarden Acquires Passwordless.dev

#308

Post by LelouBil »

RadiozRadioz wrote: post #123
thefz wrote: post #107

Earlier quoted context omitted.

Bitwarden is built as a zero knowledge platform and they can't access the contents of your Vault.

So is LastPass, but we users changed our passwords in December anyway as a precaution. Bitwarden is still a central entity that needs to be trusted to manage the zero knowledge platform with competence, e.g. not storing unencrypted metadata in a backup.

They cannot store unencrypted data because the whole vault is encrypted client side.

And thats verifiable because their clients are open source.

Re: Bitwarden Acquires Passwordless.dev

#309

Post by cco »

Ajedi32 wrote: post #203

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023. That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. I'm hopeful Bitwarden will solve that problem, and that their example wi…

> That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life.

Something that we're looking to solve at Stytch[1] from the developer's perspective. We're finding that the different platforms have their own twist on Passkeys implementation and all have different UX suggestions.

[1] https://stytch.com/

Re: Bitwarden Acquires Passwordless.dev

#310

Post by thayne »

Kimcha wrote: post #237
dcow wrote: post #213

Earlier quoted context omitted.

That's why open source is important. You can audit them and verify that they are behaving in a trustworthy manner.

Not if you are using their cloud version instead of the open source self hosted server. The code they are running does have to be the code they are publishing. And if someone compromises their cloud servers, they could also modify it to log the passwords entered.

But your data is encrypted client side. It shouldn't be too difficult to audit thay the client side code matches a build of their original sources.
Post reply on HN