321–330 of 333 posts
IANAL but if a company advertises "always free" and then starts charging, how is that not either false advertising and/or a breach of contract?
IAANAL, but always free sounds like it could fall under puffery: https://uslawexplained.com/puffery
I started looking for a replacement when I noticed how much RAM the extension was using. >1GB for a password manager seems ridiculous. I'm currently debating between Keepassium and Strongbox but I wonder if there is something better.
Strongbox already got bought out, but it's still very good and you can store the file wherever you want.
Both re pointing to the same file using SFTP (using key based auth).
I’ve also got an additional key file on each client which isn’t on the SSH server.
It’s working pretty nicely.
Bye bye Bitwarden.
Earlier quoted context omitted.
Any malware or LLM with user-level filesystem access can attack the outdated KDF [1] and/or wait for Firefox to be running with an unlocked credential store and read the decrypted passwords from Firefox's process memory. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=973759
Isn't it game over anyway once you have an adversary on your system capable of reading process memory?
When I first learnt about Bitwarden about 3 years ago, I started hosting Vaultwarden right away. Right now I have one instance for myself and another for my friend's company. Everything runs as smooth as butter. If you can self-host something, do self-host a Vaultwarden instance. If you are (like me) somewhat paranoid about the fact that Vaultwarden hasn't got a proper security audit on its codebase, just run it behi…
I'm running Vaultwarden because while on the one hand I'd like to just pay a company to make my password problem go away, I don't know who I can actually trust to not try to take advantage of the fact they have all the keys to all my kingdoms at some point. I see some people complaining about "Private Equity", with justification, and before that it was the "Harvard MBA" mindset, where businesses are encouraged to thi…
I'm trying to work out why it feels bad to trust a private company with this kind of information, whereas "we" are happy to trust AWS with our servers, Hashicorp with our Vaults, etc.
But these businesses seem to rely on some amount of scale for their trustworthiness. Password managers seem like a cottage industry in comparison, especially as lots of their users will just be "normies" and even ones on a free tier, because ~nobody thinks they should pay for a password manager?
> I don't trust Private Equity or the Harvard MBA mindset to be allowed to hold on to my passwords.
I agree, but you have credible exit. As annoying as it is, it seems quite feasible to continuously migrate to the next provider who is currently in their "don't be evil" phase.
Someone on lobste.rs suggested there should be a worker-owned co-op for password managers. This fits my personal bias, but I wonder if it would be any more resistant to this failure mode? Co-ops can be bought out also, and depend on strong leadership to prevent this.
Maybe a customer-owned co-op instead of a worker-owned one could make it more impractical to buy out. Or a foundation model like Signal, Wikipedia etc.
EDIT: I'm reminded of https://fleetdm.com/ business model, which is heavily open source yet paid. That seems like essentially what Bitwarden was? And presumably Fleet is not protected from the same outcome, no matter how inspiring their example is right now.
Earlier quoted context omitted.
IAANAL, but always free sounds like it could fall under puffery: https://uslawexplained.com/puffery
'Always free' does not sound like an opinion.
Earlier quoted context omitted.
same. Recommend as long as the house doesn't catch fire, or as long i run outside with 1 of my syncthing devices (have several), local cloud is the best.
Can I ask questions about your setup? I don't intend to grill you on it or pick it apart - I would like to go down this route further, but find myself gradually moving away from it. I switched from Keepass to Bitwarden in 2020, knowing it was just a move towards convenience. I suppose you realised you could protect against the scenario where you run outside without any devices, by just having a copy of the encrypted…
Passbolt https://www.passbolt.com/ might be an interesting alternative. The feature set looks pretty good at first sight. The only real downside I see so far is that it doesn't have macOS and Linux apps. Other than Bitwarden it is real open source.
Earlier quoted context omitted.
You should be doing regular exports/backups of your vault regardless of how it's hosted. Bitwarden could go belly up tomorrow and lose all their stored vault data.
Easier said than done. If done manually you will eventually forget, and to automate you have to wrap around a call to the bitwarden cli, which as we've seen already suffered a supply chain breach https://news.ycombinator.com/item?id=47876043 The API for managing secrets automatically is gated behind `bitwarden-cli serve` which is surprising for me that I can't call the API directly using urllib or requests directly.…
Automating this definitely seems like a bad idea, but it depends on where you're putting the backup. I put mine into encrypted, offline storage and thats not something I want to keep connected all the time for a cron job. That, and you're dealing more moving pieces (CLI with vulns like you mentioned) and automating access to your vault.
I have moved to KeepassXC[1] on my desktop from Bitwarden. On phone, I use KeepassDX[2] which is Android client compatible with KeepassXC. On browser, I use KeepassXC Browser extension which connects with the desktop client. Since KeepassXC operates on a single file, you can use any Filesystem syncing tool to sync that file between devices or to store it in the cloud. I am really happy with the move. [1]: https://kee…
The file syncing, particularly between Android phone and multiple desktop machines, is my biggest worry with this workflow. Will the synced Keepass file get corrupted if I add a new password on the phone and also on desktop, and then later try to merge them?