Good to see this. Bitwarden is one of the few companies that I actually like. And even them can dissappoint when profitability requires it seems.
Bitwarden SDK relicensed from proprietary to GPLv3
321–330 of 381 posts
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#322Earlier quoted context omitted.
Same here. TOTP is trivially phishable via evil nginx just like your password, and via social engineering. FIDO2 is not phishable and you have no secret to give out to social engineering attacks.
> TOTP is trivially phishable . . . via social engineering Is it? I've been on the Internet since the 80s and haven't been phished a single time (despite being the recipient of many obvious attempts). Maybe I could be phished, but I think that's evidence it's not trivial. I have to wonder how many people sophisticated enough to use and pay for a password manager like Bitwarden could be "trivially" phished.
That's great for you, but also a sample size of one (probably technically sophisticated) user, i.e. irrelevant to the bigger picture.
The phishability of TOTP really is exactly as bad as that of passwords, except that a once-phished TOTP isn't reusable by the attacker(s), unlike a phished password.
But even one-time access is often catastrophic, especially if it allows the attacker to rotate credentials.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#323GPLv3 is interesting because it means to use their code in a commercial setting, then you must also have the guts to open source too.
Not necessarily. You can run a “Bitwarden hosting service” or something like that without violating GPL. You’d only have to make your changes available on request if you changed the actual Bitwarden source code or linked some other library into it and shared that modified version with someone else (just running it on a server doesn’t mean you need to open source changes, for example)
Yeah; GPLv3 seems designed to give pure *aaS companies an unfair advantage over people that want to give users the option to buy commercially supported hardware that runs the company's software.
For instance, Google can use bash in their backend infrastructure, but Apple cannot ship it on MacBooks or iOS anymore.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#324Earlier quoted context omitted.
The only true 2nd factor is a setup where your totp codes live on a separate piece of physical hardware. If your totp codes are in an app on your phone, and your password is in a different app on your phone, you're not pure 2nd factor despite convincing yourself that you are. Anything that is convenient is not real 2FA. Real 2FA needs to be pick two of: a password in your head, a verifiable biometric signature, a cod…
I think you're letting perfect be the enemy of good. It doesn't have to be pure 2FA to be better than 1FA. Being in separate apps does give some benefits. It's always going to be harder to compromise two apps than it is to compromise just one of them (even if the difficulty increase is marginal, it's non-zero). Often simply not being low-hanging fruit is enough to save you from an attack. There are plenty of things f…
No I’m specifically not. Did you read my 2nd paragraph? It’s essentially your argument here.
The person I was responding to was arguing that totp in pw manager is no good. Maybe you meant to reply to them and not me?
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#325I’m relieved. Maybe the company would have survived this somehow, but they sure wouldn’t have been the techies’ darling anymore and that was going to be expensive. I hope they realized that being FOSS is their moat and it nets them a lot of goodwill (it’s the whole reason I bother with their not-quite-the-best product in the first place). The bold claim „the most trusted password manager“ was kind of justifiable whil…
I'm cautiously optimistic, but still concerned about the long term.
* I just don't see how taking $100 million can be good for users in the long run. By far the most likely outcomes are bloat or enshittification.
* bitwarden does not appear to be very forkable, ie it's a complex system written in C#. The existence of Vaultwarden helps a lot with this, but what about the client apps? Forkability is the second most important protection against user-hostile action, behind being open source in the first place.
I hope it works out. I'm a recent adopter of bitwarden, and so far the UX has blown keepass out of the water.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#326Earlier quoted context omitted.
Switching is decisively a pain. But apparently this episode was what I needed to start looking seriously into VaultWarden.
Huge VaultWarden fan here. It's been running absolutely unattended for about 3 years from a machine in my basement now, and it's great. I back things up fairly often, but otherwise I would have no idea I'm not just using the enterprise grade Bitwarden license. Things just work, features are there. Side-note - VaultWarden is incredibly reliable for a self-hosted free solution (I have 1 pod restart 27 days ago due to a…
Vaultwarden is great, but it's only half the equation. If bitwarden does go user-hostile eventually, who's going to fork all the client apps and extensions?
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#327Nice to see Bitwarden make a course correction here. I wasn't looking forward to switching to another password manager, so I'm quite happy.
Yeah, likewise. I'm a Bitwarden subscriber but I'd been looking into alternatives recently because of the licensing kerfuffle. But switching password managers is a pain, so I'm glad to not feel like I have to now.
I found psono and spun up a self-hosted instance. I may just try to keep them in sync for a while while this business fully settles
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#328Props for them to step in the right direction, it wasn’t obvious at all for a few days what they would do.
Repeatedly: when people post shit like this they more or less guarantee the next company won't even try. People! this is one of the few companies which open sources their product. The time to doubt and preach is not here yet... by far.
Not really. It was keeping them honest. This wasn't like the Winamp thing. Bitwarden has proudly proclaimed itself as "Open Source" from day one. It's right on their front page. It's in their marketing materials. It's in their podcast advertisements.
I pay for Bitwarden based on the premise that it is open source. If it tries to pull a Meta and decide that "open source" suddenly means whatever they want it to mean in defiance of the commonly-understood meaning, I want to know about it.
I'm glad they righted the ship on this.
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#329Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.
>, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But a lot of "normal people" actually need a secrets manager which is larger in scope than just a "websites urls passwords manager". This means a password manager with extra metadata fields for users to add notes, associated email aliases, etc. E.g. if a website has an extra step of "Confirm your identit…
Absolutely, everyone I recommend BW to appreciates the notes feature as well - it's handy to have a place to jot down important things that aren't log-ins!
Re: Bitwarden SDK relicensed from proprietary to GPLv3
#330Earlier quoted context omitted.
Firefox password sync just works. It's one of those things I never think about. Watching friends and family struggle with bespoke, poorly integrated password managers makes me cringe and is one of the big reasons I enjoy the seamless experience of the built-in Firefox password manager.
it just works for websites. it does not "just work" for apps where as the platform ones do or have a chance to work with apps. Kind of hope regulation will force apple/google/ms to allow iterations for 3rd parties to integrate with the os but on the other hand that will open a host of issues
iOS already has all of the API required to integrate a password manager with the OS. Third party password managers can already integrate with both browsers and apps to provide passwords and password generation