Live data from Hacker News

The quiet renovation at Bitwarden

blog.ppb1701.com

331–333 of 333 posts

Re: The quiet renovation at Bitwarden

#331
post #288

Earlier quoted context omitted.

same. Recommend as long as the house doesn't catch fire, or as long i run outside with 1 of my syncthing devices (have several), local cloud is the best.

Can I ask questions about your setup? I don't intend to grill you on it or pick it apart - I would like to go down this route further, but find myself gradually moving away from it. I switched from Keepass to Bitwarden in 2020, knowing it was just a move towards convenience. I suppose you realised you could protect against the scenario where you run outside without any devices, by just having a copy of the encrypted…

>>> by just having a copy of the encrypted data sent to some cloud service, e.g. iCloud/OneDrive/Google Drive, but decided you couldn't trust any?

False sense of security. As proven countless times in these forums, a ban on 1 product or 1 account on Google, is a ban on all of Google for that device and linked devices. I dont think you have factored in this risk. Or that commercial products get discontinued all the time. Open source (syncthing) doesn't have that issue. And we haven' touched billing yet.

>>> There's no one you would trust with an encrypted copy?

Doing password backups is particularly tricky. Commercial vendors are robust and depend on local circunstances. They do have changes in ownership which do change security priorities. Its a bit of a moving target whether they can be trusted or not. For non password needs, the answer is much simpler:No. They will sell data, at a minimum.

>>> o you have any automated backup of your phone to a cloud service, or only local?

Only local. I have 1 device parked in a relative's house that gets updated everytime i am there. That's my remote backup. But its not a daily backup, but i can live with that.

>>> I am overseas holding a new replacement for a lost phone, looking at the text "Enter the 6‑digit verification code", I will wish I'd thought about more carefully.

This is, indeed, the most important thing you must resolve. How urgent you need access to X ? Maybe you should solve for that separately. Everything else is much simpler and done.

Re: The quiet renovation at Bitwarden

#332

Earlier quoted context omitted.

Easier said than done. If done manually you will eventually forget, and to automate you have to wrap around a call to the bitwarden cli, which as we've seen already suffered a supply chain breach https://news.ycombinator.com/item?id=47876043 The API for managing secrets automatically is gated behind `bitwarden-cli serve` which is surprising for me that I can't call the API directly using urllib or requests directly.…

To me, it's not that complicated. The point of a vault backup is to not leave you completely hosed, even if it means some new entries didn't make it in. You don't really need to automate anything, set a calendar reminder every few months if you're prone to forgetting and login to do an export. Automating this definitely seems like a bad idea, but it depends on where you're putting the backup. I put mine into encrypte…

I disagree because life is more complicated than just your password manager, so you are not just adding a reminder to backup your vault, it's another thing you need to remember. That might work for you, and it's ok, for me it's a liability.

Re: The quiet renovation at Bitwarden

#333
post #2

what are some bitwarden alternatives?

I've been keeping my eye on AliasVault[1]. Open-source, self-hostable or pay for cloud hosting, handles both email aliases and passwords. I'll probably switch for password management once it has a proper security audit, and for email aliases once (if) they implement IMAP/SMTP or similar so reading emails isn't restricted to in-app. [1]: https://www.aliasvault.net/

Tried self-hosting it and importing passwords. UX was very good, but I had some understandable UI hiccoughs that made me not want to use it. The non-native Android app also felt pretty slow.
Post reply on HN