Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

311–320 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#311

Post by CuriousCosmic »

jjeaff wrote: post #175
CuriousCosmic wrote: post #80

Earlier quoted context omitted.

To add onto this, if you care about supply chain attacks, bitwarden mobile supports Fdroid builds (albeit not part of the main repo because they rely on xamarin) so you can host your own fdroid repo and run your own builds if so desired.

If you are making your own build, is there a benefit to using f-droid? Why not just install the APK?

You can just use local CI to build it and then when your F-droid checks for updates you get a push notification on your phone.

If you want to gate it, you can just periodically update the local git repo after you reviewed it (or just follow up to main minus a few days).

Re: Bitwarden Acquires Passwordless.dev

#312

Post by Fnoord »

TillE wrote: post #127
obblekk wrote: post #68

I really dislike the idea of giving complete access to my digital life to any company, particularly one that needs to grow quickly. The tech for password vaults is so simple, I use keepass + icloud syncing and get free end-to-end encrypted password syncing, without sharing any data with anyone. Outlined in more detail here: https://magoop.substack.com/p/how-to-manage-500-passwords-se...

BitWarden doesn't get "complete access to your digital life", they get an encrypted blob. It's not materially different than storing your KeePass vault in the cloud.

Microsoft too, since Bitwarden uses Azure. I think its find.

Re: Bitwarden Acquires Passwordless.dev

#313

Post by princevegeta89 »

roustem wrote: post #198
princevegeta89 wrote: post #184

Earlier quoted context omitted.

1Password in my experience was the biggest scum of bait and switch I ever faced. They used to do "lifetime" licenses which I bought into, but wouldn't support it beyond one year of release and stop giving me updates. Later, they invested heavily into the cloud side of things, and brought in confusing subscription-based pricing which made it expensive and difficult to understand. All they're doing as of now is trying…

1Password NEVER had lifetime licenses. We made this decision since day one because we had a product before that died because it was a "lifetime" purchase. The 1Password license is valid for the major version of the app. The license purchased would still work with that version today. If you look at the release history of 1Password apps — every version had a ton of updates made long after the app was no longer on sale.…

Pretty sure 1Password had "standalone" licenses. https://piunikaweb.com/2021/06/22/1password-ceases-all-licen...

The article above talks about them being shutdown

Re: Bitwarden Acquires Passwordless.dev

#314

Post by fortuna86 »

ok_dad wrote: post #192
fortuna86 wrote: post #182

Earlier quoted context omitted.

This also means creation of billion dollar global platforms that Europe and other parts of the world have never accomplished. Trade offs.

I feel so happy that we have created "billion dollar global platforms" instead of universal healthcare or ensuring everyone was sleeping indoors. Woo-hoo!

Are you implying that there are no homeless people in Europe? Or problems with poverty or access to healthcare?

Re: Bitwarden Acquires Passwordless.dev

#315

Post by arcastroe »

LelouBil wrote: post #307
Kimcha wrote: post #237

Earlier quoted context omitted.

Not if you are using their cloud version instead of the open source self hosted server. The code they are running does have to be the code they are publishing. And if someone compromises their cloud servers, they could also modify it to log the passwords entered.

They have a paper about their architecture. Basically, your master password is never sent, and everything is encrypted and decrypted locally. You can't audit the server side code, but you can audit the client (and compile it from source) to make sure that the encryption is local and the master password is not sent.

Hah, so I suppose the next step would be a browser extension that performs this auditing on every visit

Re: Bitwarden Acquires Passwordless.dev

#316

Post by cube00 »

BrandoElFollito wrote: post #269
cube00 wrote: post #243

Earlier quoted context omitted.

It's fragile if you do that. Bitwarden updated their API last month on the clients so you couldn't connect to Vaultwarden at all until the Vaultwarden team could reverse engineer the change and produce a new release.

This is interesting. I use BW daily (many times) on Android against my self-updating VW instance. I did not notice anything, maybe the break happened during the night in Europe. Or the Android app did not want about problems.

In my case I could continue to use the app, it broke the ability to sign into the vault. If you only lock your vault and not fully logout you may not have noticed it.

https://github.com/dani-garcia/vaultwarden/issues/3082

Re: Bitwarden Acquires Passwordless.dev

#317

Post by cube00 »

palata wrote: post #304
cube00 wrote: post #243

Earlier quoted context omitted.

It's fragile if you do that. Bitwarden updated their API last month on the clients so you couldn't connect to Vaultwarden at all until the Vaultwarden team could reverse engineer the change and produce a new release.

I'm confused: what do they have to reverse-engineer if it's open source?

Sorry probably not the best wording. If Bitwarden changes their API the Vaultwarden team has to act fast enough to get the same changes into the Rust version before Bitwarden updates the clients. In one case they weren't fast enough https://github.com/dani-garcia/vaultwarden/issues/3082

Re: Bitwarden Acquires Passwordless.dev

#318

Post by wkat4242 »

cmdli wrote: post #226
Ajedi32 wrote: post #203

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023. That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. I'm hopeful Bitwarden will solve that problem, and that their example wi…

Shameless plug to my own passkey manager, which is 100% open source: https://bulwark.id One of the big challenges to passkeys right now is that they aren’t as versatile as passwords, but this doesn’t have to be the case. Passkeys should be able to be exported and stored anywhere you want (ideally in an open source solution). Bulwark Passkey supports that right now, but I’m glad that other products are also providing…

The problem is that big companies don't want them to be as versatile. They don't trust us to manage our credentials.

Hence FIDO2 and Passkeys feature 'attestation' that allows them to only accept 'trusted' implementations. This accreditation is a crypto process so it can't be faked.

So, you can't just put your keys in any app you wish, like you can with TOTP. There will be strong pressure to just 'go with the flow' eg mainstream OS implementations and us with niche OS or cross platform requirements will be ever more marginalized.

Any complaints will be simply rebuked with "For security reasons" or "We only certify implementation X, Y and Z".

My work is already doing this, they only support Yubikey and one other brand through their Identity Provider, if you have one of the open source tokens you're straight out of luck. Passkeys don't work yet either but I'm sure they will only 'certify' Apple and Microsoft and leave the rest hanging. They love quoting the pareto principle / 80/20 rule as an excuse.

Re: Bitwarden Acquires Passwordless.dev

#319

Post by fIREpOK »

penciltwirler wrote: post #49

One can easily self host a bitwarden server on digitalocean. https://bitwarden.com/blog/digitalocean-marketplace/ However, I'm curious what y'all think about the cost. A digitalocean droplet for the recommended specs (4 GiB memory) is $24/month. This is hard to stomach when you compare with Bitwarden Premium which is <$1/month. I guess it depends on how much you value your own data.

I pay $12/year for my VPS... it has 1GB RAM... checkout http://www.lowendstock.com/ or similar

Re: Bitwarden Acquires Passwordless.dev

#320

Post by dcow »

Ajedi32 wrote: post #203

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023. That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. I'm hopeful Bitwarden will solve that problem, and that their example wi…

It's easy enough (not to belittle efforts that have done so) to store Passkeys in a password manager. The part that kills the flow and where it gets nefarious, though, is whether platform and browser players (Apple/Google/Microsoft/Mozilla) will allow 3rd party Passkey implementations to be selected/configured by the user as their preferred WebAuthN backend so that you can use your 3rd party implementation at login time when the website or app the user is using wants to begin a webauthn flow and lookup or create credentials.

Google said they plan to play nice and support 3rd party implementations. When I asked Apple during their Slack Q&A event on Passkeys they said that have no plans to support 3rd party implementations at the moment. I don't know how Microsoft and Mozilla feel. I would be a lot more optimistic about the whole thing if platform players would come out and commit to allowing 3rd party Passkey managers. Otherwise you'll never be an option in the system "choose which credential to use" dialog when some website/app wants to actually do webauthn.

Post reply on HN