Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

311–320 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#311

Post by whimsicalism »

solarkraft wrote: post #282

I’m relieved. Maybe the company would have survived this somehow, but they sure wouldn’t have been the techies’ darling anymore and that was going to be expensive. I hope they realized that being FOSS is their moat and it nets them a lot of goodwill (it’s the whole reason I bother with their not-quite-the-best product in the first place). The bold claim „the most trusted password manager“ was kind of justifiable whil…

the gh or had official communication. it was obviously a dep issue blown out of proportion

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#312

Post by bloopernova »

elric wrote: post #136
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

I recommend Bitwarden family plans to non-technical people. It's pretty user friendly, and you can give people emergency access. A couple of recent deaths in my life have made me painfully aware that this is something that many people really need.

Gen X and boomer techies are getting older.

It's kind of funny to see how gen x in particular deals with aging. For example, menopause memes as gen x women hit perimenopause. We're supposed to be all nonchalant and cynical, and it's interesting to see those attitudes hit the immovable object of aging.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#313

Post by spiffytech »

leshenka wrote: post #281
trinsic2 wrote: post #280

Earlier quoted context omitted.

Its Bitwarden only for personal use. Do they have a solution for Multi-use password sharing?

in Vaultwarden you can have "organizations" that are like groups of people and you can have passwords there that are accessible by members No idea how this maps into Bitwarden's own offerings though but all clients support this kind of thing

The downside is you can only share to other users on your Vaultwarden instance. You can't e.g., set up emergency sharing to family members who use cloud Bitwarden.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#314

Post by SV_BubbleTime »

blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

> built-in password manager in Firefox is too good.

lol, sorry but this is a ridiculously narrow opinion and wouldn’t even apply to my SO and me as a two person team.

Hmm, maybe I want my passwords on my phone?

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#315

Post by jvdvegt »

qwertyuiop_ wrote: post #254
jasode wrote: post #241

Earlier quoted context omitted.

>, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But a lot of "normal people" actually need a secrets manager which is larger in scope than just a "websites urls passwords manager". This means a password manager with extra metadata fields for users to add notes, associated email aliases, etc. E.g. if a website has an extra step of "Confirm your identit…

This ^ passwords just don’t live in Firefox when you are using apps that need passwords across platforms (mac ios windows) and apps. This is where Bitwarden shines.

I don't know about iOS, but Firefox syncs my passwords between my Linux machine and Android phone just fine.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#316

Post by xelamonster »

cmeacham98 wrote: post #285
idonttalkenough wrote: post #283

Earlier quoted context omitted.

Tacking onto this comment as another thumbs up for vaultwarden. "incredibly reliable" is exactly the way to describe it, in the world of tech headaches the password manager is the last thing you want to be worrying about and I can say with confidence that vaultwarden is a reliable well-oiled machine. Backups are also fairly easy so if need be a DR can be done (and automated) with very little hassle. The vaultwarden b…

Your comment was marked dead FYI, I vouched for it. Normally this would mean you are shadow banned, but I don't see any other comments in your history getting this treatment - perhaps this comment caught the ire of some anti-spam algorithm.

I mean it reads like ad copy, and the entire first paragraph takes so many words to say nothing more than "I agree." As comments go, I have to say I've seen better.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#317

Post by hedora »

BrandoElFollito wrote: post #305
hedora wrote: post #294

Earlier quoted context omitted.

I decided that vaultwarden should not have an internet accessible port. Are there any that meet those requirements and also let you (reliably!) edit/create passwords when offline? Also, sometimes the bitwarden client decides to blow away my local copy of the password database. I'd like it to store it pesistently on all machines so I have to lose my phone, my laptop, my vaultwarden server and its two backups before I…

> I decided that vaultwarden should not have an internet accessible port So how does your browser extension work when outside your LAN? via Tailscale or similar VPN mesh? And for people who use it outside of the LAN entirely?

The app (and iOS keyboard integration) degrades to read only mode. It works about 95% of the time. I'd rather it work 100% of the time, and be read-write.

I don't run the browser extension. (There have been too many other password managers with exploitable password bugs.)

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#318

Post by hedora »

SirGiggles wrote: post #185
hnbad wrote: post #150

Earlier quoted context omitted.

After reading through the issue thread and the final reply by Bitwarden, I think the only context this provides is that the headline should rather be something like "Bitwarden SDK fixes dependency licensing issue". The opening comment and the final reply are the only valuable contributions in that issue. Everything in between is random people jumping in to feign outrage or telling people to use Vaultwarden (which btw…

> (which btw recently was in the news for more significant negative reasons) Do you by chance mean CVE-2024-{39924, 39925, 39926}?

Interestingly, none of those impact me, since they involve an authenticated attacker. I trust all the users that can log into my vaultwarden instance.

Were there any other recent issues?

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#319

Post by lxgr »

dcow wrote: post #73
freedomben wrote: post #32

Earlier quoted context omitted.

There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis o…

The only true 2nd factor is a setup where your totp codes live on a separate piece of physical hardware. If your totp codes are in an app on your phone, and your password is in a different app on your phone, you're not pure 2nd factor despite convincing yourself that you are. Anything that is convenient is not real 2FA. Real 2FA needs to be pick two of: a password in your head, a verifiable biometric signature, a cod…

> Anything that is convenient is not real 2FA.

That's a pretty user-hostile attitude. Sure, some combinations of factors are pretty unergonomic, but I'd call that a bug, not a feature.

It's also incorrectly suggesting that somehow complexity/painful usability automatically yields security, while usually the opposite is true:

An effective secure authentication solution absolutely must consider usability, or it's doomed to be circumvented by users in one way or another (either via some insecure practice, or by your users simply ceasing to be your users).

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#320

Post by dcow »

KPGv2 wrote: post #264
dcow wrote: post #73

Earlier quoted context omitted.

The only true 2nd factor is a setup where your totp codes live on a separate piece of physical hardware. If your totp codes are in an app on your phone, and your password is in a different app on your phone, you're not pure 2nd factor despite convincing yourself that you are. Anything that is convenient is not real 2FA. Real 2FA needs to be pick two of: a password in your head, a verifiable biometric signature, a cod…

> Real 2FA needs to be pick two of: a password in your head, a verifiable biometric signature, a code/key on your phone or separate physical hardware yubikey. My thumbprint isn't stored on my phone, so I have two factors. From the PCI Security Standards supplement on MFA, > The issue with authentication credentials embedded into the device is a potential loss of independence between factors—i.e., physical possession…

I think you misunderstood me. I agree that biometric plus password or device key would constitute two factors. I perhaps believe that you can’t really trust the device to have performed biometric verification without some sort of software attestation. So if the security if your protocol depends on two factor, you’d need to yes have a biometric signature or remote attestation that a biometric check has been performed.
Post reply on HN